7.8
CVE-2020-8835
- EPSS 24.72%
- Published 02.04.2020 18:15:18
- Last modified 21.11.2024 05:39:32
- Source security@ubuntu.com
- Teams watchlist Login
- Open Login
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)
Data is provided by the National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.4.7 < 5.4.29
Linux ≫ Linux Kernel Version >= 5.5.0 < 5.5.14
Linux ≫ Linux Kernel Version >= 5.6 < 5.6.1
Fedoraproject ≫ Fedora Version30
Fedoraproject ≫ Fedora Version31
Fedoraproject ≫ Fedora Version32
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version19.10
Netapp ≫ Cloud Backup Version-
Netapp ≫ Hci Management Node Version-
Netapp ≫ Steelstore Cloud Integrated Storage Version-
Netapp ≫ A700s Firmware Version-
Netapp ≫ 8300 Firmware Version-
Netapp ≫ 8700 Firmware Version-
Netapp ≫ A400 Firmware Version-
Netapp ≫ A320 Firmware Version-
Netapp ≫ C190 Firmware Version-
Netapp ≫ A220 Firmware Version-
Netapp ≫ Fas2720 Firmware Version-
Netapp ≫ Fas2750 Firmware Version-
Netapp ≫ A800 Firmware Version-
Netapp ≫ H300s Firmware Version-
Netapp ≫ H500s Firmware Version-
Netapp ≫ H700s Firmware Version-
Netapp ≫ H300e Firmware Version-
Netapp ≫ H500e Firmware Version-
Netapp ≫ H700e Firmware Version-
Netapp ≫ H410s Firmware Version-
Netapp ≫ H610c Firmware Version-
Netapp ≫ H610s Firmware Version-
Netapp ≫ H615c Firmware Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 24.72% | 0.96 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.2 | 3.9 | 10 |
AV:L/AC:L/Au:N/C:C/I:C/A:C
|
| security@ubuntu.com | 7.8 | 1.1 | 6 |
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
|
CWE-125 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
CWE-787 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.