Skip to content
OpenAdvisories
High · 7.8 Public exploit CVE-2020-8835 EUVD-2020-29678GHSA-774r-wvx9-mm68

Linux kernel bpf verifier vulnerability

Published Apr 2, 2020 · Updated Sep 17, 2024 · Assigned by canonical

Vendor: Linux kernel Product: Linux kernel Package: linux Package: linux-azure-5.3 Package: linux-azure-edge Package: linux-gcp-5.3 Package: linux-gcp-edge Package: linux-gke-5.3 Package: linux-hwe Package: linux-hwe-edge Package: linux-oracle-5.3 Package: linux-raspi2 Package: linux-raspi2-5.3 Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)

Affected products

VendorProductAffectedFixed
Linux kernel Linux kernel 5.6-stable – < 5.6.1, 5.5-stable – < 5.5.14, 5.4.7 – < 5.4-stable* 5.6.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 linux 5.5.13-2 —
Debian 13 linux 5.5.13-2 —
Debian 12 linux 5.5.13-2 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS linux-raspi2 No fix yet —
Ubuntu 18.04 LTS linux-azure-5.3 5.3.0-1018.19~18.04.1 USN-4313-1
Ubuntu 18.04 LTS linux-gcp-5.3 +1 5.3.0-1016.17~18.04.1 USN-4313-1
Ubuntu 18.04 LTS linux-gcp-edge +2 No fix yet —
Ubuntu 18.04 LTS linux-hwe 5.3.0-45.37~18.04.1 USN-4313-1
Ubuntu 18.04 LTS linux-oracle-5.3 5.3.0-1013.14~18.04.1 USN-4313-1
Ubuntu 18.04 LTS linux-raspi2-5.3 5.3.0-1021.23~18.04.1 USN-4313-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 kernel-uek +4 5.4.17-2011.1.2.el8uek ELSA-2020-5663
Oracle Linux 7 perf +3 5.4.17-2011.1.2.el7uek ELSA-2020-5663

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 7 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 2

References