Bug 1177889 (CVE-2020-27194) - VUL-0: CVE-2020-27194: kernel-source: scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values, aka CID-5b9fbeb75b6a
Summary: VUL-0: CVE-2020-27194: kernel-source: scalar32_min_max_or in kernel/bpf/verif...
Status: RESOLVED FIXED
Alias: CVE-2020-27194
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Minor
Target Milestone: ---
Assignee: Joey Lee
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/269591/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-10-19 13:46 UTC by Wolfgang Frisch
Modified: 2024-06-25 15:21 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Wolfgang Frisch 2020-10-19 13:46:38 UTC 
CVE-2020-27194

An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or
in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values,
aka CID-5b9fbeb75b6a.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27194
https://github.com/torvalds/linux/commit/5b9fbeb75b6a98955f628e205ac26689bcb1383e
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27194
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.15
https://security-tracker.debian.org/tracker/CVE-2020-27194
Comment 1 Wolfgang Frisch 2020-10-19 14:11:31 UTC 
The affected code appears to have been introduced in Linux 5.7, with commit 3f50f132d8400e129fc9eb68b5020167ef80a244.
SLE should not be affected at all.
Please double-check.
Comment 2 Gary Ching-Pang Lin 2020-10-20 01:57:15 UTC 
The commit wasn't merged into SLE15-SP2 and the previous versions.

However, I recently backported the commit into SLE15-SP3, so we have to track the status for SLE15-SP3.
Comment 10 Joey Lee 2022-02-07 03:45:46 UTC 
Set this issue to fixed because Gary's update be merged to 15-SP3 kernel.

commit 948c9037f4cf11a7b650cf5e7ccada2b02a9eb78
Author: Gary Lin <glin@suse.com>
Date:   Mon Nov 2 09:32:10 2020 +0800

    Update patches.suse/bpf-Fix-scalar32_min_max_or-bounds-tracking.patch
    
    Add the bug references: bsc#1177889 and CVE-2020-27194.

diff --git a/patches.suse/bpf-Fix-scalar32_min_max_or-bounds-tracking.patch b/patches.suse/bpf-Fix-scalar32_min_max_or-bounds-tracking.patch
index 05534eba498..9350d99b251 100644
--- a/patches.suse/bpf-Fix-scalar32_min_max_or-bounds-tracking.patch
+++ b/patches.suse/bpf-Fix-scalar32_min_max_or-bounds-tracking.patch
@@ -3,7 +3,7 @@ Date: Wed, 7 Oct 2020 15:48:58 +0200
 Subject: bpf: Fix scalar32_min_max_or bounds tracking
 Patch-mainline: v5.9
 Git-commit: 5b9fbeb75b6a98955f628e205ac26689bcb1383e
-References: bsc#1177028
+References: bsc#1177028 bsc#1177889 CVE-2020-27194