Observable discrepancy in Linux kernel - CVE-2020-27170

Vulnerability identifier: #VU51774

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2020-27170

CWE-ID: CWE-203

Exploitation vector: Local access

Exploit availability: No public exploit available

Affected software:
Linux kernel
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE MicroOS
SUSE Enterprise Storage
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
CentOS
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Anolis OS
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Live Patching
SUSE Linux Enterprise High Availability
SUSE Linux Enterprise Server
SUSE Linux Enterprise Workstation Extension
SUSE Linux Enterprise Real Time Extension
SUSE Linux Enterprise Software Development Kit
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Live Patching
SUSE Linux Enterprise Module for Public Cloud
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise Module for Realtime
openEuler
Fedora
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel-livepatch-4_12_14-150_72-default
kernel-livepatch-4_12_14-150_72-default-debuginfo
kernel-livepatch-4_12_14-197_89-default
kernel-livepatch-5_3_18-24_61-default
kernel-livepatch-5_3_18-24_61-default-debuginfo
kernel-livepatch-SLE15-SP2_Update_12-debugsource
kgraft-patch-4_12_14-95_74-default
kernel-livepatch-SLE15-SP3_Update_1-debugsource
kernel-livepatch-5_3_18-59_5-default-debuginfo
kernel-livepatch-5_3_18-59_5-default
kgraft-patch-4_12_14-122_66-default
cluster-md-kmp-rt-debuginfo
kernel-devel-rt
ocfs2-kmp-rt-debuginfo
ocfs2-kmp-rt
kernel-syms-rt
kernel-rt_debug-devel
kernel-rt_debug-debugsource
kernel-rt_debug-debuginfo
kernel-rt_debug
kernel-rt-devel-debuginfo
cluster-md-kmp-rt
kernel-rt_debug-devel-debuginfo
dlm-kmp-rt
dlm-kmp-rt-debuginfo
gfs2-kmp-rt
gfs2-kmp-rt-debuginfo
kernel-rt
kernel-rt-base
kernel-rt-base-debuginfo
kernel-rt-debuginfo
kernel-rt-debugsource
kernel-rt-devel
kernel-source-rt
kernel-source-azure
kernel-devel-azure
kernel-syms-azure
kernel-azure-devel
kernel-azure-debugsource
kernel-azure-debuginfo
kernel-azure-base-debuginfo
kernel-azure-base
kernel-azure
kernel-default-debugsource
cluster-md-kmp-default-debuginfo
kernel-default-devel
kernel-default-devel-debuginfo
kernel-syms
kernel-devel
kernel-macros
kernel-source
kernel-default-man
kernel-default-kgraft
kernel-default-kgraft-devel
kernel-default-debuginfo
kernel-default-base-debuginfo
kernel-default-base
kernel-default
dlm-kmp-default-debuginfo
gfs2-kmp-default
cluster-md-kmp-default
gfs2-kmp-default-debuginfo
ocfs2-kmp-default
ocfs2-kmp-default-debuginfo
dlm-kmp-default
kernel-default-extra
kernel-default-extra-debuginfo
kernel-obs-build
kernel-obs-build-debugsource
kernel-docs
kernel-vanilla-base
kernel-vanilla-base-debuginfo
kernel-vanilla-debuginfo
kernel-vanilla-debugsource
reiserfs-kmp-default
reiserfs-kmp-default-debuginfo
kernel-default-livepatch
kernel-zfcpdump-debugsource
kernel-zfcpdump-debuginfo
kernel-default-livepatch-devel
linux-image-virtual (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-generic-lpae-hwe-16.04 (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-4.15.0-140-lowlatency (Ubuntu package)
linux-image-4.15.0-140-generic-lpae (Ubuntu package)
linux-image-4.15.0-140-generic (Ubuntu package)
linux-image-dell300x (Ubuntu package)
linux-image-4.15.0-1015-dell300x (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-4.15.0-1068-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.15.0-1082-raspi2 (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.15.0-1088-kvm (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-4.15.0-1096-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1097-aws (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.15.0-1099-snapdragon (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-4.15.0-1111-azure (Ubuntu package)
kernel-tools
kernel
perf
bpftool-debuginfo
kernel-debuginfo
python3-perf-debuginfo
kernel-tools-debuginfo
python3-perf
python2-perf
kernel-debugsource
python2-perf-debuginfo
bpftool
perf-debuginfo
kernel-tools-devel
kernel-tools-libs-devel
kernel-tools-libs
kernel-modules-internal
kernel-modules-extra
kernel-modules
kernel-headers
kernel-debug-modules-extra
kernel-debug-modules
kernel-debug-devel
kernel-debug-core
kernel-debug
kernel-core
linux-image-5.3.0-72-lowlatency (Ubuntu package)
linux-image-5.3.0-72-generic (Ubuntu package)
linux-image-gkeop-5.3 (Ubuntu package)
linux-image-raspi2-hwe-18.04 (Ubuntu package)
linux-image-5.3.0-1038-raspi2 (Ubuntu package)
linux-image-gke-5.3 (Ubuntu package)
linux-image-5.3.0-1041-gke (Ubuntu package)
kernel-azure-devel-debuginfo
kernel-preempt-extra
kernel-preempt-extra-debuginfo
kernel-preempt-debuginfo
kernel-preempt-debugsource
kernel-preempt-devel
kernel-preempt-devel-debuginfo
kernel-preempt
kernel-zfcpdump
kernel-64kb-devel-debuginfo
kernel-64kb-devel
kernel-64kb-debugsource
kernel-64kb-debuginfo
kernel-64kb
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.4.0-70-lowlatency (Ubuntu package)
linux-image-5.4.0-70-generic (Ubuntu package)
linux-image-5.4.0-70-generic-lpae (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1012-gkeop (Ubuntu package)
linux-image-gkeop-5.4 (Ubuntu package)
linux-image-gkeop (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1032-raspi (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.4.0-1036-kvm (Ubuntu package)
linux-image-5.4.0-1039-gke (Ubuntu package)
linux-image-gke-5.4 (Ubuntu package)
linux-image-5.4.0-1040-gcp (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-5.4.0-1041-aws (Ubuntu package)
linux-image-5.4.0-1041-oracle (Ubuntu package)
linux-image-5.4.0-1043-azure (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-5.6.0-1052-oem (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-5.8.0-48-generic (Ubuntu package)
linux-image-5.8.0-48-generic-64k (Ubuntu package)
linux-image-5.8.0-48-generic-lpae (Ubuntu package)
linux-image-5.8.0-48-lowlatency (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-5.8.0-1019-raspi (Ubuntu package)
linux-image-5.8.0-1019-raspi-nolpae (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-5.8.0-1022-kvm (Ubuntu package)
linux-image-5.8.0-1024-oracle (Ubuntu package)
linux-image-5.8.0-1026-gcp (Ubuntu package)
linux-image-5.8.0-1026-azure (Ubuntu package)
linux-image-5.8.0-1027-aws (Ubuntu package)
linux-image-oem-20.04b (Ubuntu package)
linux-image-5.10.0-1019-oem (Ubuntu package)
Session Smart Router

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists in kernel/bpf/verifier.c due to kernel performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations. A local user can run a specially crafted program to gain access to sensitive information.

Install updates from vendor's website.

• http://www.openwall.com/lists/oss-security/2021/03/24/4
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f232326f6966cf2a1d1db7bc917a4ce5f9f55f76
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
• https://www.openwall.com/lists/oss-security/2021/03/19/2