CVE-2020-27170 describes a side-channel vulnerability in the Linux kernel (before version 5.11.8) affecting the BPF verifier. This flaw allows out-of-bounds speculation on pointer arithmetic, potentially bypassing existing Spectre mitigations to extract sensitive information from kernel memory. With a CVSS score of 4.7 (Medium), exploitation requires local access and high attack complexity, but could lead to high confidentiality impact. While no public exploit code or active exploitation has been observed, the vulnerability has garnered some community discussion and media attention, indicating its potential significance.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.11.8CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
32CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | ||
33CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | ||
34CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | ||
14.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.4 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
kernel: Speculation on pointer arithmetic against bpf_context pointer
Mar 19, 2021An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit.
Mar 9, 2021