Out-of-bounds Read in Linux Kernel
CVE-2020-8835
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)
Vulnerability class: Buffer Overflow
EPSS: 0.060 (93.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Linux Linux_kernel
- Linux Kernel — versions 5.6-stable, 5.5-stable, 5.4.7
- Netapp 8300
- Netapp 8300_firmware
- Netapp 8700
- Netapp 8700_firmware
- Netapp A220
- Netapp A220_firmware
- Netapp A320
- Netapp A320_firmware
Weakness classification (CWE)
Public proof-of-concept exploits
- snappyJack/Rick_write_exp_CVE-2020-8835
- digamma-ai/CVE-2020-8835-verification
- WhatsWrongAndWhy/CVE-2020-8835
- johnatag/INF8602-CVE-2020-8835
- SplendidSky/CVE-2020-8835
- zilong3033/CVE-2020-8835
- Prabhashaka/Exploitation-CVE-2020-8835
- JlSakuya/Linux-Privilege-Escalation-Exploits
- KatsuragiCSL/Presentations-Blogs-Papers-Tutorials-Books
- OrangeGzY/security-research-learning
References
- security@ubuntu.com (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- security@ubuntu.com (Third Party Advisory, x_refsource_MISC)
- security@ubuntu.com (x_refsource_MISC)
- security@ubuntu.com (Patch, Mailing List, Third Party Advisory, x_refsource_MISC)
- security@ubuntu.com (Third Party Advisory, x_refsource_MISC)
- security@ubuntu.com (Patch, x_refsource_MISC, Vendor Advisory)
- security@ubuntu.com (Patch, x_refsource_MISC, Vendor Advisory)
- security@ubuntu.com (x_refsource_FEDORA, vendor-advisory)
- security@ubuntu.com (x_refsource_FEDORA, vendor-advisory)
- security@ubuntu.com (x_refsource_FEDORA, vendor-advisory)
Frequently asked questions
- What is CVE-2020-8835?
- CVE-2020-8835 is a high-severity vulnerability in Linux Kernel, classified under Out-of-bounds Read. CVSS score: 7.8/10. Published 2020-04-02.
- How severe is CVE-2020-8835?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2020-8835 known to be exploited?
- 48 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.