{"id":"CVE-2020-8835","aliases":["BELL-CVE-2020-8835","DEBIAN-CVE-2020-8835","EUVD-2020-29678","GHSA-774r-wvx9-mm68","MGASA-2020-0156","MGASA-2020-0158","UBUNTU-CVE-2020-8835","USN-4313-1"],"status":"published","title":"Linux kernel bpf verifier vulnerability","description":"In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0601,"percentile":0.93386,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-119","CWE-125","CWE-787"],"published":"2020-03-30T16:00:00Z","modified":"2026-10-26T12:02:45Z","exploits":[{"source":"pocgithub","id":"Prabhashaka/Exploitation-CVE-2020-8835","title":"Prabhashaka/Exploitation-CVE-2020-8835","date":"2020-05-12","url":"https://github.com/Prabhashaka/Exploitation-CVE-2020-8835"},{"source":"pocgithub","id":"snappyJack/Rick_write_exp_CVE-2020-8835","title":"snappyJack/Rick_write_exp_CVE-2020-8835","date":"2020-07-04","url":"https://github.com/snappyJack/Rick_write_exp_CVE-2020-8835"},{"source":"pocgithub","id":"zilong3033/CVE-2020-8835","title":"zilong3033/CVE-2020-8835","date":"2020-09-30","url":"https://github.com/zilong3033/CVE-2020-8835"},{"source":"pocgithub","id":"SplendidSky/CVE-2020-8835","title":"SplendidSky/CVE-2020-8835","date":"2020-10-18","url":"https://github.com/SplendidSky/CVE-2020-8835"},{"source":"metasploit","id":"exploit/linux/local/cve_2021_3490_ebpf_alu32_bounds_check_lpe","title":"Linux eBPF ALU32 32-bit Invalid Bounds Tracking LPE","type":"exploit","platform":"Linux","date":"2021-05-11","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/local/cve_2021_3490_ebpf_alu32_bounds_check_lpe"},{"source":"pocgithub","id":"digamma-ai/CVE-2020-8835-verification","title":"digamma-ai/CVE-2020-8835-verification","date":"2021-06-04","url":"https://github.com/digamma-ai/CVE-2020-8835-verification"},{"source":"pocgithub","id":"johnatag/INF8602-CVE-2020-8835","title":"johnatag/INF8602-CVE-2020-8835","date":"2023-03-20","url":"https://github.com/johnatag/INF8602-CVE-2020-8835"},{"source":"pocgithub","id":"WhatsWrongAndWhy/CVE-2020-8835","title":"WhatsWrongAndWhy/CVE-2020-8835","date":"2026-07-21","url":"https://github.com/WhatsWrongAndWhy/CVE-2020-8835"}],"fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["5.5.13-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["5.5.13-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["5.5.13-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","fixed_in":["5.3.0-1018.19~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","fixed_in":["5.3.0-1016.17~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.3","fixed_in":["5.3.0-1016.17~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","fixed_in":["5.3.0-45.37~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","fixed_in":["5.3.0-1013.14~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"linux-raspi2-5.3","fixed_in":["5.3.0-1021.23~18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.13-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.13-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.13-2"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.18-8.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8-8.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"wireguard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20200319-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"exfat-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.15-1.mga7"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-1018.19~18.04.1"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-1016.17~18.04.1"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-1016.17~18.04.1"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-45.37~18.04.1"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-1013.14~18.04.1"}]}],"versions":["5.3.0-1011.12~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-raspi2-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-1021.23~18.04.1"}]}],"versions":["5.3.0-1017.19~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1019.21~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1004.5~18.04.1","4.18.0-1005.6~18.04.1","4.18.0-1006.7~18.04.1","4.18.0-1007.8~18.04.1","4.18.0-1008.9~18.04.1","4.18.0-1009.10~18.04.1","4.18.0-1011.12~18.04.1","4.18.0-1012.13~18.04.1","4.18.0-1013.14~18.04.1","4.18.0-1015.16~18.04.1","5.0.0-1011.11~18.04.1","5.0.0-1013.13~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-1018.19~18.04.1"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-1016.17~18.04.1"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-1016.17~18.04.1"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-45.37~18.04.1"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-1013.14~18.04.1"}]}],"versions":["5.3.0-1011.12~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-raspi2-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-1021.23~18.04.1"}]}],"versions":["5.3.0-1017.19~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1019.21~18.04.1"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"linux","product":"linux_kernel"},{"vendor":"linux kernel","product":"linux kernel"},{"vendor":"netapp","product":"8300_firmware"},{"vendor":"netapp","product":"8700_firmware"},{"vendor":"netapp","product":"a220_firmware"},{"vendor":"netapp","product":"a320_firmware"},{"vendor":"netapp","product":"a400_firmware"},{"vendor":"netapp","product":"a700s_firmware"},{"vendor":"netapp","product":"a800_firmware"},{"vendor":"netapp","product":"c190_firmware"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"netapp","product":"fas2720_firmware"},{"vendor":"netapp","product":"fas2750_firmware"},{"vendor":"netapp","product":"h300e_firmware"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500e_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h610c_firmware"},{"vendor":"netapp","product":"h610s_firmware"},{"vendor":"netapp","product":"h615c_firmware"},{"vendor":"netapp","product":"h700e_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"hci_management_node"},{"vendor":"netapp","product":"solidfire"},{"vendor":"netapp","product":"steelstore_cloud_integrated_storage"}],"references":[{"url":"https://usn.ubuntu.com/4313-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.thezdi.com/blog/2020/3/19/pwn2own-2020-day-one-results","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lore.kernel.org/bpf/20200330160324.15259-1-daniel%40iogearbox.net/T/","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.openwall.com/lists/oss-security/2020/03/30/3","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"https://usn.ubuntu.com/usn/usn-4313-1","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fef","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f2d67fec0b43edce8c416101cdc52e71145b5fef","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7OONYGMSYBEFHLHZJK3GOI5Z553G4LD/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXBWSHZ6DJIZVXKXGZPK6QPFCY7VKZEG/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TF4PQZBEPNXDSK5DOBMW54OCLP25FTCD/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20200430-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/07/20/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8835"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7OONYGMSYBEFHLHZJK3GOI5Z553G4LD"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TF4PQZBEPNXDSK5DOBMW54OCLP25FTCD"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXBWSHZ6DJIZVXKXGZPK6QPFCY7VKZEG"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7OONYGMSYBEFHLHZJK3GOI5Z553G4LD"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TF4PQZBEPNXDSK5DOBMW54OCLP25FTCD"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YXBWSHZ6DJIZVXKXGZPK6QPFCY7VKZEG"},{"url":"https://lore.kernel.org/bpf/20200330160324.15259-1-daniel%40iogearbox.net/T"},{"url":"https://lore.kernel.org/bpf/20200330160324.15259-1-daniel@iogearbox.net/T"},{"url":"https://security.netapp.com/advisory/ntap-20200430-0004"},{"url":"https://usn.ubuntu.com/4313-1"},{"url":"https://github.com/advisories/GHSA-774r-wvx9-mm68"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-8835","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-8835","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0156.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26420","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.10","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.11","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.12","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.13","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.14","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2020-0158.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26426","tags":["report"]},{"url":"https://kernelnewbies.org/Linux_5.5","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.1","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.2","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.3","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.4","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.5","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.6","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.7","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.8","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.9","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5.15","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-8835","tags":["report"]},{"url":"https://lore.kernel.org/bpf/20200330160324.15259-1-daniel@iogearbox.net/T/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4313-1","tags":["advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-350/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8835","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-8835","title":"Linux kernel bpf verifier vulnerability","description":"In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)","status":"published","published":"2020-04-02T18:00:23.885Z","modified":"2024-09-17T02:15:48.82Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2020-29678","description":"In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)","status":"published","published":"2020-04-02T18:00:23Z","modified":"2024-09-17T02:15:48Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:42.412483Z"}],"ghsa":[{"id":"GHSA-774r-wvx9-mm68","title":"In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly...","description":"In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)","status":"published","published":"2022-05-24T17:13:20Z","modified":"2024-04-04T02:49:43Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-125"],"updated_at":"2026-11-02T14:56:12.154453Z"}],"nvd":[{"id":"CVE-2020-8835","description":"In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)","status":"published","published":"2020-04-02T18:15:18.943Z","modified":"2026-06-17T03:27:01.963Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T14:05:57.678762Z"}],"osv":[{"id":"BELL-CVE-2020-8835","title":"CVE-2020-8835 does not affect BellSoft software","status":"withdrawn","published":"2020-04-02T18:15:00Z","modified":"2026-01-26T09:46:43.220011Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-8835","description":"In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)","status":"published","published":"2020-04-02T18:15:18.943Z","modified":"2026-04-16T04:44:30.785091473Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2020-8835","description":"In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)","status":"published","published":"2020-04-02T18:15:18.943Z","modified":"2026-10-26T12:02:45.261593913Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"UBUNTU-CVE-2020-8835","description":"In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)","status":"published","published":"2020-03-30T16:00:00Z","modified":"2026-02-04T03:31:12.836447Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"MGASA-2020-0156","title":"Updated kernel packages fix security vulnerabilities","description":"This update is based on upstream 5.5.14 and fixes at least the following\nsecurity vulnerabilities:\n\nIn the Linux kernel 5.3.10, there is a use-after-free (read) in the\nperf_trace_lock_acquire function (related to include/trace/events/lock.h)\n(CVE-2019-19769).\n\nManfred Paul discovered that the bpf verifier in the Linux kernel did not\nproperly calculate register bounds for certain operations. A local attacker\ncould use this to expose sensitive information (kernel memory) or gain\nadministrative privileges (CVE-2020-8835).\n\nSecurity fixes and hardenings to the mac00211 layer to prevent leaking keys\nand frames.\n\nOther notable changes in this update:\n- WireGuard kernel module has been updated to v1.0.20200330 and the tools\n  to v1.0.20200319.\n- exfat-utils has been rebuilt in core (was previously in tainted) as we\n  now also ship the official upstream exfat driver.\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2020-04-02T22:48:49Z","modified":"2026-04-16T04:40:50.769872805Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"MGASA-2020-0158","title":"Updated kernel-linus packages fix security vulnerabilities","description":"This update is based on upstream 5.5.15 and fixes at least the following\nsecurity vulnerabilities:\n\nIn the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the\n__blk_add_trace function in kernel/trace/blktrace.c (which is used to\nfill out a blk_io_trace structure and place it in a per-cpu sub-buffer)\n(CVE-2019-19768).\n\nIn the Linux kernel 5.3.10, there is a use-after-free (read) in the\nperf_trace_lock_acquire function (related to include/trace/events/lock.h)\n(CVE-2019-19769).\n\nA flaw was found in the way KVM hypervisor handled instruction emulation\nfor the L2 guest when nested(=1) virtualization is enabled. In the\ninstruction emulation, the L2 guest could trick the L0 hypervisor into\naccessing sensitive bits of the L1 hypervisor. An L2 guest could use this\nflaw to potentially access information of the L1 hypervisor\n(CVE-2020-2732).\n\nThere is a use-after-free vulnerability in the Linux kernel through 5.5.2\nin the vc_do_resize function in drivers/tty/vt/vt.c (CVE-2020-8647).\n\nThere is a use-after-free vulnerability in the Linux kernel through 5.5.2\nin the n_tty_receive_buf_common function in drivers/tty/n_tty.c\n(CVE-2020-8648).\n\nManfred Paul discovered that the bpf verifier in the Linux kernel did not\nproperly calculate register bounds for certain operations. A local attacker\ncould use this to expose sensitive information (kernel memory) or gain\nadministrative privileges (CVE-2020-8835).\n\nThere is a use-after-free vulnerability in the Linux kernel through 5.5.2\nin the vgacon_invert_region function in drivers/video/console/vgacon.c. \n(CVE-2020-8649).\n\nAn issue was discovered in the Linux kernel through 5.5.6. set_fdc in\ndrivers/block/floppy.c leads to a wait_til_ready out-of-bounds read\nbecause the FDC index is not checked for errors before assigning it,\naka CID-2e90ca68b0d2 (CVE-2020-9383).\n\nAn issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6\non the AArch64 architecture. It ignores the top byte in the address\npassed to the brk system call, potentially moving the memory break\ndownwards when the application expects it to move upwards, aka CID-\ndcde237319e6. This has been observed to cause heap corruption with\nthe GNU C Library malloc implementation (CVE-2020-9391).\n\nSecurity fixes and hardenings to the mac00211 layer to prevent leaking keys\nand frames.\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2020-04-03T22:53:32Z","modified":"2026-04-16T04:43:19.061402369Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"USN-4313-1","title":"linux, linux-aws, linux-azure, linux-azure-5.3, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-oracle-5.3, linux-raspi2, linux-raspi2-5.3 vulnerability","description":"Manfred Paul discovered that the bpf verifier in the Linux kernel did not\nproperly calculate register bounds for certain operations. A local attacker\ncould use this to expose sensitive information (kernel memory) or gain\nadministrative privileges.\n","status":"published","published":"2020-03-30T18:10:34Z","modified":"2026-02-10T04:41:48Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}