UBUNTU-CVE-2020-8835

Advisory lineage Upstream: 1 Downstream: 1
Upstream
CVE-2020-8835
Downstream
USN-4313-1
Published: 30 Mar 2020, 16:00
Last modified:04 Feb 2026, 03:31

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.8 HIGH
3.1 (osv_ubuntu)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

30 Mar 2020, 16:00
Published
Vulnerability first disclosed
04 Feb 2026, 03:31
Last Modified
Vulnerability information updated

Description

In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)

CVSS Metrics

  • v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Systems

  • ubuntu•linux-azure-5.3

    < 5.3.0-1018.19~18.04.1

  • ubuntu•linux-azure-edge

    all

  • ubuntu•linux-gcp-5.3

    < 5.3.0-1016.17~18.04.1

  • ubuntu•linux-gcp-edge

    all

  • ubuntu•linux-gke-5.3

    < 5.3.0-1016.17~18.04.1

  • ubuntu•linux-hwe

    < 5.3.0-45.37~18.04.1

  • ubuntu•linux-hwe-edge

    all

  • ubuntu•linux-oracle-5.3

    < 5.3.0-1013.14~18.04.1

  • ubuntu•linux-raspi2

    all

  • ubuntu•linux-raspi2-5.3

    < 5.3.0-1021.23~18.04.1

References (8)