CVE-2020-8835: Linux Kernel Use-After-Free Vulnerability

CVE-2020-8835 Overview

CVE-2020-8835 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) verifier located in kernel/bpf/verifier.c. The verifier failed to properly restrict register bounds for 32-bit operations, allowing crafted BPF programs to trigger out-of-bounds reads and writes in kernel memory [CWE-125]. Affected versions include Linux kernel 5.5.0 and newer, plus the 5.4 stable series starting at v5.4.7 due to a backported commit. The flaw was demonstrated at Pwn2Own 2020 and tracked as ZDI-CAN-10780. Fixes shipped in kernel versions 5.6.1, 5.5.14, and 5.4.29.

Critical Impact
A local unprivileged attacker who can load BPF programs gains the ability to read and write arbitrary kernel memory, leading to local privilege escalation to root.

Affected Products

Linux kernel versions 5.4.7 through 5.4.28, 5.5.0 through 5.5.13, and 5.6.0
Ubuntu Linux 18.04 LTS and 19.10; Fedora 30, 31, and 32
NetApp products including SolidFire, HCI Management Node, Cloud Backup, SteelStore, and multiple AFF/FAS/H-Series firmware platforms

Discovery Timeline

2020-03-19 - Vulnerability demonstrated at Pwn2Own 2020 (ZDI-CAN-10780)
2020-03-30 - Public disclosure on the Openwall oss-security list
2020-04-02 - CVE-2020-8835 published to NVD
2020-04-30 - NetApp Security Advisory NTAP-20200430-0004 released
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-8835

Vulnerability Analysis

The Linux BPF subsystem includes a static verifier that validates BPF programs before they run in kernel context. The verifier tracks value ranges for each register to prevent unsafe memory accesses. CVE-2020-8835 stems from incorrect register bound tracking when 32-bit ALU operations are performed on registers that previously held 64-bit values. The verifier did not properly update the 32-bit min/max bounds, allowing an attacker to construct a program that the verifier believes is safe but actually computes arbitrary pointer offsets at runtime. The result is out-of-bounds reads and writes against kernel memory from a context that the verifier has already approved.

Root Cause

The __reg_bound_offset32 and related bound-narrowing routines in kernel/bpf/verifier.c failed to correctly synchronize 32-bit register tracking with 64-bit tracking. When a program performed 32-bit operations, the verifier produced overly permissive bounds. An attacker crafts a sequence of arithmetic operations that exploits this gap, causing the verifier to accept a program whose actual runtime register values fall outside the validated range. This is a classic class of bug in static verification where the abstract domain diverges from concrete execution.

Attack Vector

Exploitation requires local access and the ability to load eBPF programs. On systems where unprivileged BPF is enabled (kernel.unprivileged_bpf_disabled=0), any local user can trigger the flaw. With unprivileged BPF disabled, a process needs CAP_SYS_ADMIN or CAP_BPF. A successful attacker constructs a BPF program that bypasses verifier bounds checks, then uses arbitrary kernel read/write primitives to overwrite credentials structures or kernel function pointers and escalate to root. Technical details are documented in the upstream fix commit f2d67fec0b43 available at git.kernel.org and in the ZDI Pwn2Own 2020 writeup.

Detection Methods for CVE-2020-8835

Indicators of Compromise

Unexpected bpf() syscall activity from non-root or unprivileged user accounts, especially with BPF_PROG_LOAD commands
Sudden privilege transitions where a previously unprivileged process gains UID 0 without invoking a setuid binary
Kernel log entries showing BPF verifier rejections followed by repeated retry attempts from the same PID

Detection Strategies

Audit the bpf() syscall using auditd rules to record program load attempts and the loading UID
Monitor /proc/sys/kernel/unprivileged_bpf_disabled for runtime changes that would expand the attack surface
Correlate BPF program loads with subsequent capability changes or credential modifications in process telemetry

Monitoring Recommendations

Forward kernel audit logs and EDR process telemetry to a centralized SIEM for correlation across hosts
Track kernel version inventory continuously to identify hosts running 5.4.7–5.4.28, 5.5.0–5.5.13, or 5.6.0
Alert on local privilege escalation patterns such as unexpected root shells spawned from unprivileged parent processes

How to Mitigate CVE-2020-8835

Immediate Actions Required

Patch affected systems to Linux kernel 5.6.1, 5.5.14, 5.4.29, or later as supplied by your distribution
Apply the Ubuntu update via USN-4313-1 and the corresponding Fedora package announcements
For NetApp appliances, follow remediation guidance in NTAP-20200430-0004

Patch Information

The upstream fix is commit f2d67fec0b43edce8c416101cdc52e71145b5fef in the Linux kernel tree, available at the Torvalds repository. Fixed releases are 5.6.1, 5.5.14, and 5.4.29. Distribution-specific updates were released by Ubuntu and Fedora; check vendor advisories for backports to your supported kernel branch.

Workarounds

Disable unprivileged BPF program loading by setting kernel.unprivileged_bpf_disabled=1 in /etc/sysctl.d/ and reloading sysctl
Restrict CAP_SYS_ADMIN and CAP_BPF to only trusted service accounts and audit any grants in container runtimes
Apply seccomp filters in container and sandbox profiles to block the bpf() syscall for workloads that do not require it

bash

# Configuration example: disable unprivileged BPF at runtime and on boot
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-disable-unpriv-bpf.conf
sudo sysctl --system

# Verify current kernel version against fixed releases (>= 5.4.29, 5.5.14, 5.6.1)
uname -r