CVE-2020-27171
Summary
| CVE | CVE-2020-27171 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-03-20 22:15:00 UTC |
|---|
| Updated | 2023-11-07 03:20:00 UTC |
|---|
| Description | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 32 Update: kernel-5.11.10-100.fc32 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 33 Update: kernel-5.11.8-200.fc33 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| oss-security - Re: [CVE-2020-27171] Numeric error when restricting speculative
pointer arithmetic allows unprivileged local users to leak content of kernel memory |
MLIST |
www.openwall.com |
|
| [SECURITY] [DLA 2610-1] linux-4.19 security update |
MLIST |
lists.debian.org |
|
| Kernel Live Patch Security Notice LSN-0075-1 ≈ Packet Storm |
MISC |
packetstormsecurity.com |
|
| git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch |
MISC |
git.kernel.org |
|
| [SECURITY] Fedora 33 Update: kernel-5.11.8-200.fc33 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 34 Update: kernel-5.11.8-300.fc34 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8 |
MISC |
cdn.kernel.org |
|
| oss-security - [CVE-2020-27171] Numeric error when restricting speculative pointer
arithmetic allows unprivileged local users to leak content of kernel memory |
MISC |
www.openwall.com |
|
| [SECURITY] Fedora 34 Update: kernel-5.11.8-300.fc34 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 32 Update: kernel-5.11.10-100.fc32 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159135 Oracle Enterprise Linux Security Update for Unbreakable Enterprise kernel (ELSA-2021-9140)
- 159136 Oracle Enterprise Linux Security Update for Unbreakable Enterprise kernel-container (ELSA-2021-9141)
- 159179 Oracle Enterprise Linux Security Update for Unbreakable Enterprise kernel (ELSA-2021-9222)
- 159180 Oracle Enterprise Linux Security Update for Unbreakable Enterprise kernel-container (ELSA-2021-9223)
- 174896 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:1177-1)
- 174897 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:1175-1)
- 174916 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:1210-1)
- 174917 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:1211-1)
- 174919 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:1238-1)
- 178507 Debian Security Update for linux-4.19 (DLA 2610-1)
- 198307 Ubuntu Security Notification for Linux, Linux-aws, Linux-aws-5.4, Linux-azure, Linux-azure-5.4, Linux-gcp, (USN-4887-1)
- 198309 Ubuntu Security Notification for Linux, Linux-aws, Linux-aws-hwe, Linux-azure, Linux-azure-4.15, (USN-4890-1)
- 281069 Fedora Security Update for kernel (FEDORA-2021-e49da8a226)
- 281407 Fedora Security Update for kernel (FEDORA-2021-9503fffad9)
- 281433 Fedora Security Update for kernel (FEDORA-2021-f0181b8085)
- 281434 Fedora Security Update for kernel (FEDORA-2021-e49da8a226)
- 352274 Amazon Linux Security Advisory for kernel: ALAS2-2021-1627
- 610351 Google Pixel Android July 2021 Security Patch Missing
- 610358 Google Android July 2021 Security Patch Missing for Huawei EMUI
- 670416 EulerOS Security Update for kernel (EulerOS-SA-2021-1983)
- 670438 EulerOS Security Update for kernel (EulerOS-SA-2021-2062)
- 670449 EulerOS Security Update for kernel (EulerOS-SA-2021-2051)
- 750004 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:1573-1)
- 750006 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:1596-1)
- 750015 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:1624-1)
- 750199 OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2021:0758-1)
- 750276 OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2021:0532-1)
- 750650 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:1975-1)
- 750652 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2021:1977-1)
- 750762 OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2021:1977-1)
- 750766 OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2021:1975-1)
- 900100 CBL-Mariner Linux Security Update for kernel 5.10.52.1
- 900305 CBL-Mariner Linux Security Update for kernel 5.10.57.1
- 900320 CBL-Mariner Linux Security Update for kernel 5.10.60.1
- 901643 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (6526-1)
- 903400 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (3990)
- 906022 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (3990-1)
