CVE-2020-8835: Linux kernel bpf verifier vulnerability
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.259-1Fixed in 6.1.176-1Fixed in 6.12.94-1Fixed in 6.12.95-1Fixed in 7.1.3-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.6.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.5.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.4.29 - Configuration
Set the sysctl kernel.unprivileged_bpf_disabled to 1 (e.g., via /etc/sysctl.d/90-CVE-2020-8835.conf) to mitigate out-of-bounds access in the BPF verifier.
Linux kernel kernel.unprivileged_bpf_disabled = 1 - Compensating control
Alternatively, rely on Linux secure boot / kernel lockdown, which blocks kernel.unprivileged_bpf_disabled from being set to 1, as a mitigation for this vulnerability.
Event History
Frequently Asked Questions
What is the severity of CVE-2020-8835?
CVE-2020-8835 has been classified as a high-severity vulnerability due to its potential to allow out-of-bounds reads and writes in kernel memory.
How do I fix CVE-2020-8835?
To fix CVE-2020-8835, you should update the Linux kernel to the latest stable version or apply the relevant patches provided by your Linux distribution.
Which Linux kernel versions are affected by CVE-2020-8835?
CVE-2020-8835 affects Linux kernel versions 5.5.0 and newer, as well as specific versions in the 5.4 stable series.
What are the potential impacts of exploiting CVE-2020-8835?
Exploitation of CVE-2020-8835 could lead to unauthorized access to sensitive data and could compromise the stability of the system.
Is CVE-2020-8835 specific to certain Linux distributions?
CVE-2020-8835 affects multiple Linux distributions, including Debian, Fedora, and Ubuntu, that utilize the vulnerable versions of the kernel.