Security advisory

{
  "id": "883786a5934074c6df3a94c6fb46a6b2960253a7c66e82f56783eea0bec44edd",
  "url": "https://osv.dev/vulnerability/CVE-2020-28346",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2020-28346",
    "summary": "ACRN through 2.2 has a devicemodel/hw/pci/virtio/virtio.c NULL Pointer Dereference.",
    "evidence": "osv:CVE-2020-28346",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2020-28346",
      "aliases": [
        "CVE-2020-28346"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/projectacrn/acrn-hypervisor",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "be85d092c40db8ccc1bd95457a3f6d08eeaf7403"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:projectacrn:acrn:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "2.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.2",
            "acrn-2020w40.1-180000p",
            "acrn-2020w39.4-180000p",
            "acrn-2020w39.1-180000p",
            "acrn-2020w38.3-180000p",
            "acrn-2020w37.4-180000p",
            "acrn-2020w37.3-180000p",
            "acrn-2020w36.4-180000p",
            "acrn-2020w36.3-180000p",
            "acrn-2020w35.4-180000p",
            "acrn-2020w35.2-180000p",
            "acrn-2020w34.5-180000p",
            "acrn-2020w33.5-180000p",
            "acrn-2020w33.4-180000p",
            "acrn-2020w32.3-180000p",
            "acrn-2020w30.5-180000p",
            "acrn-2020w29.4-180000p",
            "acrn-2020w28.5-180000p",
            "acrn-2020w28.3-180000p",
            "acrn-2020w27.5-180000p",
            "acrn-2020w27.3-180000p",
            "acrn-2020w26.7-180000p",
            "acrn-2020w25.5-180000p",
            "acrn-2020w24.4-180000p",
            "acrn-2020w23.5-180000p",
            "acrn-2020w23.4-180000p",
            "acrn-2020w22.5-180000p",
            "acrn-2020w21.5-180000p",
            "acrn-2020w20.5-180000p",
            "acrn-2020w19.5-140000p",
            "acrn-2020w17.4-140000p",
            "acrn-2020w17.3-140000p",
            "acrn-2020w17.1-140000p",
            "acrn-2020w16.3-140000p",
            "acrn-2020w15.4-140000p",
            "acrn-2020w15.2-140000p",
            "acrn-2020w14.3-140000p",
            "acrn-2020w13.4-140000p",
            "acrn-2020w12.1-140000p",
            "acrn-2020w11.5-140000p",
            "acrn-2020w11.3-140000p",
            "acrn-2020w10.5-140000p",
            "acrn-2020w10.2-140000p",
            "acrn-2020w09.4-140000p",
            "acrn-2020w09.2-140000p",
            "acrn-2020w08.4-140000p",
            "acrn-2020w08.1-140000p",
            "acrn-2020w07.3-140000p",
            "acrn-2020w07.1-140000p",
            "acrn-2020w04.1-140000p",
            "acrn-2020w03.4-140000p",
            "acrn-2020w02.5-140000p",
            "acrn-2020w02.1-140000p",
            "acrn-2019w50.5-140000p",
            "acrn-2019w50.3-140000p",
            "acrn-2019w49.4-140000p",
            "acrn-2019w49.3-140000p",
            "acrn-2019w48.5-140000p",
            "acrn-2019w48.3-140000p",
            "acrn-2019w48.1-140000p",
            "acrn-2019w47.3-140000p",
            "acrn-2019w46.4-140000p",
            "acrn-2019w46.2-140000p",
            "acrn-2019w43.5-140000p",
            "acrn-2019w43.3-140000p",
            "acrn-2019w43.1-140000p",
            "acrn-2019w42.4-140000p",
            "acrn-2019w42.3-140000p",
            "acrn-2019w42.2-140000p",
            "acrn-2019w42.1-140000p",
            "acrn-2019w41.4-140000p",
            "acrn-2019w41.3-140000p",
            "acrn-2019w37.4-140000p",
            "acrn-2019w38.1-140000p",
            "acrn-2019w37.3-140000p",
            "acrn-2019w37.2-140000p",
            "acrn-2019w37.1-140000p",
            "acrn-2019w36.5-140000p",
            "acrn-2019w36.2-140000p",
            "acrn-2019w35.1-140000p",
            "acrn-2019w34.1-140000f",
            "acrn-2019w33.5-140000p",
            "acrn-2019w31.5-140000p",
            "acrn-2019w33.3-140000p",
            "acrn-2019w33.1-140000p",
            "acrn-2019w32.5-140000p",
            "acrn-2019w32.4-140000p",
            "acrn-2019w32.2-140000p",
            "acrn-2019w31.3-140000p",
            "acrn-2019w31.2-140000p",
            "acrn-2019w30.5-140000p",
            "acrn-2019w30.4-140000p",
            "acrn-2019w30.3-140000p",
            "acrn-2019w30.2-140000p",
            "acrn-2019w30.1-140000p",
            "acrn-2019w29.5-140000p",
            "acrn-2019w29.4-140000p",
            "acrn-2019w29.3-140000p",
            "acrn-2019w29.2-140000p",
            "acrn-2019w29.1-140000p",
            "acrn-2019w28.5-140000p",
            "acrn-2019w28.4-140000p",
            "acrn-2019w28.3-140000p",
            "acrn-2019w28.2-140000p",
            "acrn-2019w28.1-140000p",
            "acrn-2019w27.4-140000p",
            "acrn-2019w27.3-140000p",
            "acrn-2019w27.2-140000p",
            "acrn-2019w27.1-140000p",
            "acrn-2019w26.5-140000p",
            "acrn-2019w26.4-140000p",
            "acrn-2019w26.3-140000p",
            "acrn-2019w26.2-140000p",
            "acrn-2019w26.1-140000p",
            "acrn-2019w25.5-140000p",
            "acrn-2019w25.4-140000p",
            "acrn-2019w23.4-140000p",
            "acrn-2019w23.1-140000p",
            "acrn-2019w22.5-140000p",
            "acrn-2019w22.4-140000p",
            "acrn-2019w22.3-140000p",
            "acrn-2019w22.2-140000p",
            "acrn-2019w22.1-140000p",
            "acrn-2019w21.5-140000p",
            "acrn-2019w21.4-140000p",
            "acrn-2019w21.3-140000p",
            "acrn-2019w21.2-140000p",
            "acrn-2019w21.1-140000p",
            "acrn-2019w20.5-140000p",
            "acrn-2019w20.4-140000p",
            "acrn-2019w20.3-140000f",
            "acrn-2019w20.2-140000p",
            "acrn-2019w20.1-140000p",
            "acrn-2019w19.5-140000p",
            "acrn-2019w19.4-140000p",
            "acrn-2019w19.3-140000p",
            "acrn-2019w19.2-140000p",
            "acrn-2019w19.1-140000p",
            "acrn-2019w18.7-140000p",
            "acrn-2019w16.3-140000p",
            "acrn-2019w16.5-140000p",
            "acrn-2019w16.4-140000p",
            "acrn-2019w16.2-140000p",
            "acrn-2019w16.1-140000p",
            "acrn-2019w15.5-140000p",
            "acrn-2019w15.4-140000p",
            "acrn-2019w15.3-140000f",
            "acrn-2019w14.1-140000p",
            "acrn-2019w15.1-140000p",
            "acrn-2019w14.4-140000p",
            "acrn-2019w14.3-140000p",
            "acrn-2019w13.5-140000p",
            "acrn-2019w13.4-140000p",
            "acrn-2019w13.3-140000p",
            "acrn-2019w13.2-140000p",
            "acrn-2019w13.1-140000f",
            "acrn-2019w12.5-140000f",
            "acrn-2019w12.4-140000f",
            "acrn-2019w12.2-140000p",
            "acrn-2019w11.5-140000p",
            "acrn-2019w11.4-140000p",
            "acrn-2019w09.5-140000p",
            "acrn-2019w10.3-140000p",
            "acrn-2019w10.2-140000p",
            "acrn-2019w09.2-140000p",
            "acrn-2019w08.5-140000p",
            "acrn-2019w08.4-140000p",
            "acrn-2019w08.1-140000p",
            "acrn-2019w07.3-140000f",
            "acrn-2019w05.4-140000p",
            "acrn-2019w07.2-140000f",
            "acrn-2019w05.2-140000p",
            "acrn-2019w04.5-140000f",
            "acrn-2019w04.4-140000p",
            "acrn-2019w04.2-140000p",
            "acrn-2019w04.1-140000p",
            "acrn-2019w03.3-140000p",
            "acrn-2019w01.5-170000p",
            "acrn-2019w02.4-140000p",
            "acrn-2019w02.1-140000p",
            "acrn-2019w01.5-140000p",
            "acrn-2019w01.3-140000p",
            "acrn-2018w52.5-140000p",
            "acrn-2018w52.4-140000p",
            "acrn-2018w50.2-230000p",
            "acrn-2018w52.2-140000p",
            "acrn-2018w52.1-140000p",
            "acrn-2018w51.2-140000p",
            "acrn-2018w51.5-140000p",
            "acrn-2018w51.4-140000p",
            "acrn-2018w51.1-140000f",
            "acrn-2018w50.5-140000p",
            "acrn-2018w50.3-140000p",
            "acrn-2018w50.2-140000p",
            "acrn-2018w50.1-140000p",
            "acrn-2018w49.5-140000p",
            "acrn-2018w49.4-140000p",
            "acrn-2018w49.3-140000p",
            "acrn-2018w49.2-140000p",
            "acrn-2018w49.1-140000p",
            "acrn-2018w48.5-140000p",
            "acrn-2018w48.4-140000p",
            "acrn-2018w48.3-140000p",
            "acrn-2018w45.5-140000p",
            "acrn-2018w47.4-140000p",
            "acrn-2018w47.3-140000p",
            "acrn-2018w47.2-140000p",
            "acrn-2018w47.1-140000p",
            "acrn-2018w46.5-140000p",
            "acrn-2018w46.4-140000p",
            "acrn-2018w46.3-140000p",
            "acrn-2018w46.2-140000p",
            "v0.3",
            "acrn-2018w46.1-140000p",
            "acrn-2018w45.4-140000p",
            "acrn-2018w45.3-140000p",
            "acrn-2018w45.2-140000f",
            "acrn-2018w45.1-140000p",
            "acrn-2018w44.5-140000f",
            "acrn-2018w44.4-140000p",
            "acrn-2018w44.3-140000p",
            "acrn-2018w44.2-140000p",
            "acrn-2018w44.1-140000p",
            "acrn-2018w43.5-140000p",
            "acrn-2018w43.4-140000p",
            "acrn-2018w43.3-140000f",
            "acrn-2018w43.2-140000f",
            "acrn-2018w43.1-140000p",
            "acrn-2018w42.5-140000p",
            "acrn-2018w42.4-140000f",
            "acrn-2018w42.3-140000f",
            "acrn-2018w42.2-140000p",
            "acrn-2018w42.1-140000f",
            "acrn-2018w41.5-140000f",
            "acrn-2018w41.4-140000p",
            "acrn-2018w41.3-140000f",
            "acrn-2018w41.2-140000p",
            "acrn-2018w41.1-140000p",
            "acrn-2018w40.0-140000p",
            "acrn-2018w39.6-140000p",
            "acrn-2018w39.5-140000p",
            "acrn-2018w39.4-140000p",
            "acrn-2018w39.3-140000p",
            "acrn-2018w39.2-140000p",
            "v0.2",
            "acrn-2018w38.4-140000p",
            "acrn-2018w38.3-140000p",
            "acrn-2018w38.2-140000f",
            "acrn-2018w38.1-140000p",
            "acrn-2018w37.5-140000p",
            "acrn-2018w37.4-140000p",
            "acrn-2018w37.3-140000f",
            "acrn-2018w37.2-140000p",
            "acrn-2018w37.1-140000f",
            "acrn-2018w36.5-140000p",
            "acrn-2018w36.4-140000f",
            "acrn-2018w36.3-140000p",
            "acrn-2018w36.2-140000p",
            "acrn-2018w36.1-140000f",
            "acrn-2018w35.5-140000p",
            "acrn-2018w34.4-140000p",
            "acrn-2018w35.4-140000p",
            "acrn-2018w35.3-140000p",
            "acrn-2018w35.2-140000p",
            "acrn-2018w35.1-140000p",
            "acrn-2018w34.5-140000p",
            "acrn-2018w34.3-140000p",
            "acrn-2018w34.2-184430p",
            "acrn-2018w34.2-140000p",
            "acrn-2018w34.1-140000p",
            "acrn-2018w33.5-140000p",
            "acrn-2018w33.4-140000p",
            "acrn-2018w33.3-140000p",
            "acrn-2018w33.2-140000p",
            "acrn-2018w33.1-140000f",
            "acrn-2018w32.5-140000p",
            "acrn-2018w32.4-140000p",
            "acrn-2018w32.3-140000p",
            "acrn-2018w32.2-140000p",
            "acrn-2018w32.1-140000p",
            "acrn-2018w31.5-140000f",
            "acrn-2018w31.4-140000f",
            "acrn-2018w31.3-140000p",
            "acrn-2018w31.2-140000f",
            "acrn-2018w31.1-140000p",
            "acrn-2018w30.5-140000p",
            "acrn-2018w30.4-140000p",
            "acrn-2018w30.3-140000p",
            "acrn-2018w30.2-140000p",
            "acrn-2018w30.1-140000p",
            "acrn-2018w29.5-140000p",
            "acrn-2018w29.4-140000p",
            "acrn-2018w29.3-140000p",
            "acrn-2018w29.2-140000p",
            "acrn-2018w29.1-140000p",
            "acrn-2018w28.5-140000p",
            "v0.1",
            "acrn-2018w28.4-140000p",
            "acrn-2018w28.3-140000p",
            "acrn-2018w28.2-140000f",
            "acrn-2018w28.1-140000p",
            "acrn-2018w27.5-140000p",
            "acrn-2018w27.4-140000p",
            "acrn-2018w27.3-140000p",
            "acrn-2018w27.2-140000p",
            "acrn-2018w27.1-140000p",
            "acrn-2018w26.5-140000p",
            "acrn-2018w26.4-140000p",
            "acrn-2018w26.1-160000p",
            "acrn-2018w25.5-140000p",
            "acrn-2018w25.4-140000p",
            "acrn-2018w25.3-140000f",
            "acrn-2018w25.2-133000p",
            "acrn-2018w24.6-182200p",
            "acrn-2018w24.4-165000p",
            "acrn-2018w24.3-170000p",
            "acrn-2018w23.5-160000p",
            "acrn-2018w24.2-165000p",
            "acrn-2018w24.1-170000p",
            "acrn-2018w23.5-173000p",
            "acrn-2018w23.4-165500p",
            "acrn-2018w23.3-204500p",
            "acrn-2018w23.2-215300p",
            "acrn-2018w23.2-175000p",
            "acrn-2018w23.1-180000p",
            "acrn-2018w22.5-192000p",
            "acrn-2018w22.5-173000p",
            "acrn-2018w22.4-163000p",
            "v0.1-rc5",
            "acrn-2018w22.3-170000p",
            "acrn-2018w22.2-170000p",
            "acrn-2018w22.1-180000p",
            "acrn-2018w21.5-160000p",
            "acrn-2018w21.4-215600p",
            "acrn-2018w21.4-160000p",
            "acrn-2018w21.3-160000p",
            "acrn-2018w21.2-160000p",
            "acrn-2018w21.1-162300p",
            "acrn-2018w20.6-081600p",
            "acrn-2018w20.5-163000p",
            "acrn-2018w20.4-173000p",
            "acrn-2018w20.3-162732p",
            "v0.1-rc4",
            "v0.1-rc3",
            "v0.1-rc2",
            "v0.1-rc1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-28346.json"
          }
        }
      ],
      "modified": "2026-10-20T10:54:19.729261340Z",
      "provider": "osv",
      "references": [
        "https://github.com/projectacrn/acrn-hypervisor/pull/5453",
        "https://github.com/projectacrn/acrn-hypervisor/pull/5453/commits/ae0ab82434509d6e75f4a2f1e1a0dd2ee3dc3681"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2020-28346",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 385057,
  "published_at": "2021-03-26T04:15:14.61+00:00"
}