LiveActive security incident?Get immediate response
CVE Record

CVE-2020-8835: Linux kernel bpf verifier vulnerability

In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel flaw in the eBPF verifier. A user who already has local low-privileged access could potentially read or write kernel memory, leading to system takeover. It is not a remote entry point, but it matters for shared servers, developer workstations, and container hosts.

Executive priority

Treat as high priority for Linux fleets with shared access or containerized workloads. It is not described as remotely exploitable, but successful local exploitation could compromise kernel confidentiality, integrity, and availability.

Technical view

The verifier in kernel/bpf/verifier.c failed to correctly restrict register bounds for 32-bit operations. Sources describe resulting out-of-bounds kernel memory reads and writes. The issue affects Linux 5.5.0 and newer and Linux 5.4 stable starting at 5.4.7, with fixes listed in 5.6.1, 5.5.14, and 5.4.29.

Likely exposure

Exposure is most likely on Linux systems running affected 5.4, 5.5, or 5.6-era kernels where local users, workloads, or containers can execute code. Appliance exposure depends on vendor-shipped kernels and advisories.

Exploitation context

The CVSS vector is local, high complexity, low privileges, and no user interaction. The bundle notes ZDI-CAN-10780 and Pwn2Own context, but KEV is false and no cited source establishes active exploitation in the wild.

Researcher notes

Focus review on affected kernel ranges and downstream backports. The introducing commit was backported to Linux 5.4 stable starting at 5.4.7, so version checks must include 5.4. Validate through vendor package metadata rather than upstream version alone.

Mitigation direction

  • Upgrade to fixed Linux kernel versions: 5.6.1, 5.5.14, 5.4.29, or later vendor builds.
  • Apply distribution security updates from Ubuntu, Fedora, or the relevant appliance vendor.
  • Prioritize shared Linux hosts, container platforms, CI runners, and developer systems with untrusted local code.
  • If immediate patching is not possible, consult vendor guidance for supported temporary mitigations.
  • Track downstream vendor advisories for products embedding affected Linux kernels.

Validation and detection

  • Inventory Linux kernel versions across servers, workstations, containers hosts, and appliances.
  • Flag Linux 5.5.0 or newer before fixed releases, and Linux 5.4.7 through 5.4.28.
  • Verify installed vendor kernel package versions against Ubuntu, Fedora, or vendor advisories.
  • Confirm whether untrusted local users or workloads can execute code on affected systems.
  • Record patched kernel versions and reboot status after remediation.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-8835 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
12Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H1.16Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2020-8835Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Linux kernelLinux kernel5.6-stable, 5.5-stable, 5.4.7Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.