CVE-2020-8835
HIGHLinux kernel <5.6.1, <5.5.14, <5.4.29 - Memory Corruption
Title source: llmExploitation Summary
EIP tracks 6 public exploits for CVE-2020-8835. PoCs published by snappyJack, digamma-ai, zilong3033.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2020-8835, leveraging BPF map operations to achieve local privilege escalation (LPE) by overwriting kernel memory structures. The exploit uses BPF socket filters to leak kernel addresses, bypass KASLR, and manipulate the modprobe_path to execute arbitrary commands with root privileges.
Description
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)
Exploits (6)
This repository contains a functional exploit for CVE-2020-8835, leveraging BPF map operations to achieve local privilege escalation (LPE) by overwriting kernel memory structures. The exploit uses BPF socket filters to leak kernel addresses, bypass KASLR, and manipulate the modprobe_path to execute arbitrary commands with root privileges.
This repository provides a formal verification of CVE-2021-31440 (incorrectly referenced as CVE-2020-8835) using Coq, demonstrating the bug in the Linux kernel eBPF verifier's bounds calculation. It includes both buggy and corrected implementations of the vulnerable function for comparative analysis.
This repository contains a functional exploit for CVE-2020-8835, a Linux kernel vulnerability in the BPF verifier that allows out-of-bounds memory access. The exploit leverages BPF instructions to trigger the vulnerability and includes detailed mitigation steps.
This repository contains a functional exploit PoC for CVE-2020-8835, which involves a Linux kernel vulnerability related to unprivileged BPF (Berkeley Packet Filter) operations. The PoC includes a Node.js server and Docker configurations to test the exploit, as well as instructions for mitigating the vulnerability by disabling unprivileged BPF.
This repository contains a functional exploit PoC for CVE-2020-8835, which involves a vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The provided code includes BPF-related operations and a PoC to trigger the vulnerability.
References (12)
Scores
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H