CVE-2020-8835
Linux kernel bpf verifier vulnerability
HIGH 7.8EPSS 6.0%
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)
- Affected
- Linux kernel
- CVSS v3.1 NVD
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 UBUNTU
- 7.8 HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS v2.0 NVD
- 7.2 HIGH
AV:L/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 6.01% chance of exploitation in the next 30 days, 93rd percentile
- Published
- 2020-04-02
- Updated
- 2024-09-17
Proof-of-concept exploits (9)
- http://www.openwall.com/lists/oss-security/2021/07/20/1
- Prabhashaka/Exploitation-CVE-2020-88350★ · 2020-05-12
- Prabhashaka/IT19147192-CVE-2020-88350★ · 2020-05-12
- SplendidSky/CVE-2020-88350★ · 2020-10-18
- johnatag/INF8602-CVE-2020-88350★ · 2023-03-31
- snappyJack/Rick_write_exp_CVE-2020-88354★ · 2020-07-04
- zilong3033/CVE-2020-88350★ · 2020-09-18
- WhatsWrongAndWhy/CVE-2020-88350★ · 2026-07-21
- mrmilady/ebpf-kernel-exploits0★ · 2026-10-09
Metasploit modules (1)
Security advisories
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=f2d67fec0b…
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f2d67fec0b4…
- https://security.netapp.com/advisory/ntap-20200430-0004
- https://usn.ubuntu.com/4313-1
- https://usn.ubuntu.com/usn/usn-4313-1
- https://www.openwall.com/lists/oss-security/2020/03/30/3
- https://www.thezdi.com/blog/2020/3/19/pwn2own-2020-day-one-results