CVE-2020-27194

An out-of-bounds access flaw was found in the Linux kernel’s implementation of the eBPF (Berkeley Packet Filter) code verifier, where an incorrect register bounds calculation occurs while in use of 64-bit values with scalar32_min_max_or (that is BPF_OR). This flaw allows an unprivileged local user (until param kernel.unprivileged_bpf_disabled is set) to have arbitrary read/write access to the kernel memory or escalate their privileges on the system.

Mitigation

For Red Hat Enterprise Linux, the Berkeley Packet Filter is available only for privileged users. However, if enabled for an unprivileged user, the mitigation is to disable unprivileged access to the BPF using the following sysctl: kernel.unprivileged_bpf_disabled=1.