CVE-2020-27171: Medium severity linux kernel vulnerability
An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-27171?
CVE-2020-27171 is considered critical due to its potential to enable side-channel attacks that can bypass mitigations for Spectre vulnerabilities.
How do I fix CVE-2020-27171?
To fix CVE-2020-27171, update the Linux kernel to version 5.11.8 or later, or apply available patches for affected distributions.
Which Linux distributions are affected by CVE-2020-27171?
CVE-2020-27171 affects multiple distributions including Fedora, Debian, and Ubuntu versions prior to their respective security updates.
What kind of vulnerability is CVE-2020-27171?
CVE-2020-27171 is an off-by-one error in the Linux kernel's BPF verifier that can lead to integer underflow and side-channel attacks.
What is the potential impact of CVE-2020-27171?
The potential impact of CVE-2020-27171 includes unauthorized access to sensitive information through process memory exposure.