CVE-2020-8835
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.01%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 6.01% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-125, CWE-787
- Affected
- linux/linux kernel · fedoraproject/fedora · canonical/ubuntu linux · netapp/cloud backup · netapp/hci management node · netapp/solidfire · netapp/steelstore cloud integrated storage · netapp/a700s firmware · netapp/8300 firmware · netapp/8700 firmware · netapp/a400 firmware · netapp/a320 firmware · netapp/c190 firmware · netapp/a220 firmware · netapp/fas2720 firmware · netapp/fas2750 firmware · netapp/a800 firmware · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · +7 more
- Source
- security@ubuntu.com
References
- http://www.openwall.com/lists/oss-security/2021/07/20/1Exploit, Mailing List, Third Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fefPatch, Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fefPatch, Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7OONYGMSYBEFHLHZJK3GOI5Z553G4LD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TF4PQZBEPNXDSK5DOBMW54OCLP25FTCD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXBWSHZ6DJIZVXKXGZPK6QPFCY7VKZEG/
- https://lore.kernel.org/bpf/20200330160324.15259-1-daniel%40iogearbox.net/T/
- https://security.netapp.com/advisory/ntap-20200430-0004/Third Party Advisory
- https://usn.ubuntu.com/4313-1/Third Party Advisory
- https://usn.ubuntu.com/usn/usn-4313-1Third Party Advisory
- https://www.openwall.com/lists/oss-security/2020/03/30/3Mailing List, Patch, Third Party Advisory
- https://www.thezdi.com/blog/2020/3/19/pwn2own-2020-day-one-resultsThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/07/20/1Exploit, Mailing List, Third Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fefPatch, Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fefPatch, Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7OONYGMSYBEFHLHZJK3GOI5Z553G4LD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TF4PQZBEPNXDSK5DOBMW54OCLP25FTCD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXBWSHZ6DJIZVXKXGZPK6QPFCY7VKZEG/
- https://lore.kernel.org/bpf/20200330160324.15259-1-daniel%40iogearbox.net/T/
- https://security.netapp.com/advisory/ntap-20200430-0004/Third Party Advisory
- https://usn.ubuntu.com/4313-1/Third Party Advisory
- https://usn.ubuntu.com/usn/usn-4313-1Third Party Advisory
- https://www.openwall.com/lists/oss-security/2020/03/30/3Mailing List, Patch, Third Party Advisory
- https://www.thezdi.com/blog/2020/3/19/pwn2own-2020-day-one-resultsThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.