CVE-2020-27170

Published: 18 March 2021

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit.

From the Ubuntu Security Team

Piotr Krysiuk discovered that the BPF subsystem in the Linux kernel did not properly apply speculative execution limits on some pointer types. A local attacker could use this to expose sensitive information (kernel memory).

Notes

According to the upstream advisory,
f232326f6966cf2a1d1db7bc917a4ce5f9f55f76 is the minimal fix but the whole
series should be applied together

kernels before 4.15 are not affected by this.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27170
• https://www.openwall.com/lists/oss-security/2021/03/19/2
• https://ubuntu.com/security/notices/USN-4887-1
• https://ubuntu.com/security/notices/USN-4890-1
• NVD
• Launchpad
• Debian