CVE-2020-27171

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d.

• CWE-193

• http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.htmlThird Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2021/03/24/5Mailing List, Third Party Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8Patch, Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=10d2bb2e6b1d8c4576c56a748f697dbeb8388899Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/03/msg00035.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T2S3I4SLRNRUQDOFYUS6IUAZMQNMPNLG/
• https://www.openwall.com/lists/oss-security/2021/03/19/3Mailing List, Patch, Third Party Advisory
• http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.htmlThird Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2021/03/24/5Mailing List, Third Party Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8Patch, Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=10d2bb2e6b1d8c4576c56a748f697dbeb8388899Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/03/msg00035.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T2S3I4SLRNRUQDOFYUS6IUAZMQNMPNLG/
• https://www.openwall.com/lists/oss-security/2021/03/19/3Mailing List, Patch, Third Party Advisory

Published

Mar 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2716Vulnerability in the Oracle Banking Corporate Lending produc…6.5
• CVE-2020-27160Addressed remote code execution vulnerability in AvailableAp…9.8
• CVE-2020-27163phpRedisAdmin before 1.13.2 allows XSS via the login.php use…6.1
• CVE-2020-27165Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-2717Vulnerability in the Oracle Banking Corporate Lending produc…5.4
• CVE-2020-27170An issue was discovered in the Linux kernel before 5.11.8. k…4.7
• CVE-2020-27172An issue was discovered in G-Data before 25.5.9.25 using Sym…9.8
• CVE-2020-27173In vm-superio before 0.1.1, the serial console FIFO can grow…7.5
• CVE-2020-27174In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0…7.5
• CVE-2020-27176Mutation XSS exists in Mark Text through 0.16.2 that leads t…9.6
• CVE-2020-27178Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x be…7.5
• CVE-2020-27179konzept-ix publiXone before 2020.015 allows attackers to tak…9.8