CVE-2020-27170: Infoleak
A flaw was found in the Linux kernels eBPF verification code. By default accessing the eBPF verifier is only accessible to privileged users with CAPSYSADMIN. A local user with the ability to insert eBPF instructions can use the eBPF verifier to abuse a spectre like flaw where they can infer all system memory.
Other sources
An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects pointer types that do not define a ptrlimit.
Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by an out-of-bounds loads flaw. By executing specially-crafted BPF programs, an attacker could exploit this vulnerability to obtain contents of kernel memory, and use this information to launch further attacks against the affected system.
— IBM
Speculation on pointer arithmetic against bpfcontext pointer allows unprivileged local users to leak content of kernel memory.
Bug Fix
The minimal fix is:
bpf: Prohibit alu ops for pointer types not defining ptrlimit [ https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=f232326f6966cf2a1d1db7bc917a4ce5f9f55f76 ]
However it is recommended to use the whole series that also includes fix for another similar vulnerability reported at the same time and improvements of the affected code:
bpf: Prohibit alu ops for pointer types not defining ptrlimit [ https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=f232326f6966cf2a1d1db7bc917a4ce5f9f55f76 ] bpf: Fix off-by-one for area size in creating mask to left [ https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=10d2bb2e6b1d8c4576c56a748f697dbeb8388899 ] bpf: Simplify alulimit masking for pointer arithmetic [ https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=b5871dca250cd391885218b99cc015aca1a51aea ] bpf: Add sanity check for upper ptrlimit [ https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=1b1597e64e1a610c7a96710fc4717158e98a08b3 ] bpf, selftests: Fix up some testverifier cases for unprivileged [ https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=0a13e3537ea67452d549a6a80da3776d6b7dedb3 ]
— Red Hat
Affected Software
Remediation
Information
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-27170?
The severity of CVE-2020-27170 is classified as medium.
How do I fix CVE-2020-27170?
To fix CVE-2020-27170, update to the latest kernel version that contains the patch for this vulnerability.
Which Linux kernel versions are affected by CVE-2020-27170?
CVE-2020-27170 affects Linux kernel versions prior to 5.11.8.
Is CVE-2020-27170 exploitable remotely?
CVE-2020-27170 is a local vulnerability and cannot be exploited remotely.
What types of systems are impacted by CVE-2020-27170?
CVE-2020-27170 impacts systems running affected versions of the Linux kernel and certain distributions like Red Hat, Ubuntu, and Debian.