CVE-2020-27194: Medium severity Linux Linux kernel vulnerability
An issue was discovered in the Linux kernel before 5.8.15. scalar32minmaxor in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values, aka CID-5b9fbeb75b6a.
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access does an attacker need?
Exploitation requires local access and low privileges; no user interaction is required. The impact is denial of service, with no confidentiality or integrity impact indicated by the supplied vector.
How can I determine whether a system is affected?
Systems running a Linux kernel version earlier than 5.8.15 are affected. The listed Ubuntu kernel packages include linux, linux-aws, linux-azure, linux-hwe-edge, linux-lts-xenial, linux-aws-5.0, and linux-aws-5.3.
Is public exploit information available?
Yes. A proof of concept is flagged, and an exploit was published on 2020-11-04.
What remediation is available?
A patch is available. Update to a kernel release containing the fix for CID-5b9fbeb75b6a; Linux kernel 5.8.15 includes the referenced change.