Vulnerability Details : CVE-2020-8835
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)
Vulnerability category: Memory Corruption
Products affected by CVE-2020-8835
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:a320_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:c190_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:a220_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:fas2720_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:fas2750_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:a800_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:8300_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:8700_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:a400_firmware:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-8835
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 35 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-8835
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
1.1
|
6.0
|
Canonical Ltd. |
CWE ids for CVE-2020-8835
-
The product reads data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-8835
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TF4PQZBEPNXDSK5DOBMW54OCLP25FTCD/
[SECURITY] Fedora 30 Update: kernel-tools-5.5.16-100.fc30 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://usn.ubuntu.com/4313-1/
USN-4313-1: Linux kernel vulnerability | Ubuntu security noticesThird Party Advisory
-
http://www.openwall.com/lists/oss-security/2021/07/20/1
oss-security - CVE-2021-33909: size_t-to-int vulnerability in Linux's filesystem layerExploit;Mailing List;Third Party Advisory
-
https://www.openwall.com/lists/oss-security/2020/03/30/3
oss-security - CVE-2020-8835: Linux kernel bpf incorrect verifier vulnerabilityMailing List;Patch;Third Party Advisory
-
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fef
kernel/git/netdev/net-next.git - Netdev Group's -next networking treePatch;Vendor Advisory
-
https://usn.ubuntu.com/usn/usn-4313-1
USN-4313-1: Linux kernel vulnerability | Ubuntu security noticesThird Party Advisory
-
https://security.netapp.com/advisory/ntap-20200430-0004/
April 2020 Linux Kernel Vulnerabilities in NetApp Products | NetApp Product SecurityThird Party Advisory
-
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fef
kernel/git/torvalds/linux.git - Linux kernel source treePatch;Vendor Advisory
-
https://www.thezdi.com/blog/2020/3/19/pwn2own-2020-day-one-results
Zero Day Initiative — Pwn2Own 2020 – Day One ResultsThird Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YXBWSHZ6DJIZVXKXGZPK6QPFCY7VKZEG/
[SECURITY] Fedora 31 Update: kernel-5.5.15-200.fc31 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7OONYGMSYBEFHLHZJK3GOI5Z553G4LD/
[SECURITY] Fedora 32 Update: kernel-5.6.2-300.fc32 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lore.kernel.org/bpf/20200330160324.15259-1-daniel@iogearbox.net/T/
[PATCH bpf-next 0/3] Fix __reg_bound_offset32 handlingPatch;Vendor Advisory
Jump to