What’s Vulnerable › Vulnerabilities
CVE-2020-8835: Linux kernel bpf verifier vulnerability
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 6.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-04-02 · updated 2026-06-17
- Weakness: CWE-125
Description
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)
Affected products
- Canonical Ubuntu Linux: 18.04, 19.10
- Fedoraproject Fedora: 30, 31, 32
- Linux kernel: from 5.4.7 before 5.4.29; from 5.5.0 before 5.5.14; from 5.6 before 5.6.1 — fixed in 5.4.29, 5.5.14, 5.6.1
- NetApp 8300 Firmware: all versions
- NetApp 8700 Firmware: all versions
- NetApp A220 Firmware: all versions
- NetApp A320 Firmware: all versions
- NetApp A400 Firmware: all versions
- NetApp A700S Firmware: all versions
- NetApp A800 Firmware: all versions
- NetApp C190 Firmware: all versions
- NetApp Cloud Backup: all versions
- NetApp Fas2720 Firmware: all versions
- NetApp Fas2750 Firmware: all versions
- NetApp H300E Firmware: all versions
- NetApp H300S Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500E Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H610C Firmware: all versions
- NetApp H610S Firmware: all versions
- NetApp H615C Firmware: all versions
- NetApp H700E Firmware: all versions
- NetApp H700S Firmware: all versions
- NetApp Hci Management Node: all versions
- NetApp Solidfire: all versions
- NetApp Steelstore Cloud Integrated Storage: all versions
How to fix
Upgrade to a fixed version: Linux kernel 5.4.29, 5.5.14, 5.6.1. Check the vendor advisory for mitigations.
References
- http://www.openwall.com/lists/oss-security/2021/07/20/1
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fef
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fef
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7OONYGMSYBEFHLHZJK3GOI5Z553G4LD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TF4PQZBEPNXDSK5DOBMW54OCLP25FTCD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXBWSHZ6DJIZVXKXGZPK6QPFCY7VKZEG/
- https://lore.kernel.org/bpf/20200330160324.15259-1-daniel%40iogearbox.net/T/
- https://security.netapp.com/advisory/ntap-20200430-0004/
- https://usn.ubuntu.com/4313-1/
- https://usn.ubuntu.com/usn/usn-4313-1
- https://www.openwall.com/lists/oss-security/2020/03/30/3
- https://www.thezdi.com/blog/2020/3/19/pwn2own-2020-day-one-results
Get alerted when CVE-2020-8835 or the next vulnerability affects your stack