Date: Mon, 30 Mar 2020 09:36:24 -0700 From: Steve Beattie <steve@...w.org> To: oss-security@...ts.openwall.com Subject: CVE-2020-8835: Linux kernel bpf incorrect verifier vulnerability [re-sending, apologies if a prior version makes it to the list.] Manfred Paul, as part of the ZDI pwn2own competition, demonstrated that a flaw existed in the bpf verifier for 32bit operations. This was introduced in commit: 581738a681b6 ("bpf: Provide better register bounds after jmp32 instructions") The result is that register bounds were improperly calculated, allowing out-of-bounds reads and writes to occur. This issue affects 5.5 kernels, and was backported to 5.4-stable as b4de258dede528f88f401259aab3147fb6da1ddf. The Linux kernel bpf maintainers recommend reverting the patch for stable releases: https://firstname.lastname@example.org/T/ This bpf functionality is available to unprivileged users unless the kernel.unprivileged_bpf_disabled sysctl is set to 1. This issue has been identified as CVE-2020-8835 (and ZDI-CAN-10780). https://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-8835.html -- Steve Beattie <sbeattie@...ntu.com> http://NxNW.org/~steve/ Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.