CVE-2020-11884
published 2020-04-29CVE-2020-11884: In the Linux kernel 4.19 through 5.6.7 on the s390 platform, code execution may occur because of a race condition, as demonstrated by code in…
PriorityP430high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.40%
32.5th percentile
In the Linux kernel 4.19 through 5.6.7 on the s390 platform, code execution may occur because of a race condition, as demonstrated by code in enable_sacf_uaccess in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade, aka CID-3f777e19d171. A crash could also occur.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 5.6.7-1 (bookworm) | linux 5.6.7-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| linux | linux_kernel | >= 0 < 5.6.7-1 | 5.6.7-1 |
| linux | linux_kernel | >= 0 < 5.6.7-1 | 5.6.7-1 |
| linux | linux_kernel | >= 0 < 5.6.7-1 | 5.6.7-1 |
| linux | linux_kernel | >= 0 < 5.6.7-1 | 5.6.7-1 |
| linux | linux_kernel | >= 0 < 4.15.0-99.100 | 4.15.0-99.100 |
| linux | linux_kernel | >= 4.15 < 4.19.119 | 4.19.119 |
| linux | linux_kernel | >= 4.20 < 5.4.36 | 5.4.36 |
| linux | linux_kernel | >= 5.5 < 5.6.8 | 5.6.8 |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_kernel_5.4.91-11_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv7.0HIGH
vendor_debian7.0HIGH
vendor_msrc7.0HIGH
vendor_redhat7.0HIGH
vendor_ubuntu4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-04-30·CVSS 4.7
CVE-2019-16234 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Al Viro discovered that the Linux kernel for s390x systems did not properly
perform page table upgrades for kernel sections that use secondary address
mode. A local attacker could use this to cause a denial of service (system
crash) or execute arbitrary code. (CVE-2020-11884)
It was discovered that the Intel Wi-Fi driver in the Linux kernel did not
properly check for errors in some situations. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2019-16234)
Tristan Madani discovered that the block I/O tracing implementation in the
Linux kernel contained a race condition. A local attacker could use this to
cause a denial of service (system crash) or
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-04-28·CVSS 4.7
CVE-2019-16234 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Al Viro discovered that the Linux kernel for s390x systems did not properly
perform page table upgrades for kernel sections that use secondary address
mode. A local attacker could use this to cause a denial of service (system
crash) or execute arbitrary code. (CVE-2020-11884)
It was discovered that the Intel Wi-Fi driver in the Linux kernel did not
properly check for errors in some situations. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2019-16234)
Tristan Madani discovered that the block I/O tracing implementation in the
Linux kernel contained a race condition. A local attacker could use this to
cause a denial of service (system crash) or
Ubuntu
Linux kernel vulnerability
vendor_ubuntu·2020-04-28
CVE-2020-11884 Linux kernel vulnerability
Title: Linux kernel vulnerability
Summary: Systems running on s390x architecture could be made to crash or run
programs as an administrator under certain conditions.
Al Viro discovered that the Linux kernel for s390x systems did not properly
perform page table upgrades for kernel sections that use secondary address
mode. A local attacker could use this to cause a denial of service (system
crash) or execute arbitrary code.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel m
Red Hat
Kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation
vendor_redhat·2020-04-28·CVSS 7.0
CVE-2020-11884 [HIGH] CWE-1251 Kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation
Kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation
In the Linux kernel 4.19 through 5.6.7 on the s390 platform, code execution may occur because of a race condition, as demonstrated by code in enable_sacf_uaccess in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade, aka CID-3f777e19d171. A crash could also occur.
A flaw was found in the Linux kernel on s390 architecture. The issue occurs on multiprocessing systems when one s390 CPU is in Secondary Address Mode and another CPU does a kernel page table upgrade. An inter-processor interrupt (IPI) is then sent to each active CPU to update the control registers with new page table addresses. In Secondary Address Mode the CPU's CR1 register may hold kernel space addre
Microsoft
In the Linux kernel 4.19 through 5.6.7 on the s390 platform code execution may occur because of a race condition as demonstrated by code in enable_sacf_uaccess in arch/s390/lib/uaccess.c that fails to
vendor_msrc·2020-04-14·CVSS 7.0
CVE-2020-11884 [HIGH] CWE-362 In the Linux kernel 4.19 through 5.6.7 on the s390 platform code execution may occur because of a race condition as demonstrated by code in enable_sacf_uaccess in arch/s390/lib/uaccess.c that fails to
In the Linux kernel 4.19 through 5.6.7 on the s390 platform code execution may occur because of a race condition as demonstrated by code in enable_sacf_uaccess in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade aka CID-3f777e19d171. A crash could also occur.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this bl
Debian
CVE-2020-11884: linux - In the Linux kernel 4.19 through 5.6.7 on the s390 platform, code execution may ...
vendor_debian·2020·CVSS 7.0
CVE-2020-11884 [HIGH] CVE-2020-11884: linux - In the Linux kernel 4.19 through 5.6.7 on the s390 platform, code execution may ...
In the Linux kernel 4.19 through 5.6.7 on the s390 platform, code execution may occur because of a race condition, as demonstrated by code in enable_sacf_uaccess in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade, aka CID-3f777e19d171. A crash could also occur.
Scope: local
bookworm: resolved (fixed in 5.6.7-1)
bullseye: resolved (fixed in 5.6.7-1)
forky: resolved (fixed in 5.6.7-1)
sid: resolved (fixed in 5.6.7-1)
trixie: resolved (fixed in 5.6.7-1)
GHSA
GHSA-grcc-xgjx-xwf8: In the Linux kernel through 5
ghsa_unreviewed·2022-05-24
CVE-2020-11884 [MEDIUM] CWE-362 GHSA-grcc-xgjx-xwf8: In the Linux kernel through 5
In the Linux kernel through 5.6.7 on the s390 platform, code execution may occur because of a race condition, as demonstrated by code in enable_sacf_uaccess in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade, aka CID-3f777e19d171. A crash could also occur.
OSV
linux, linux-aws, linux-azure, linux-azure-5.3, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-oracle-5.3, linux-raspi2, linux-raspi2-5.3 vulnerabilities
osv·2020-04-30·CVSS 4.7
CVE-2020-11884 [MEDIUM] linux, linux-aws, linux-azure, linux-azure-5.3, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-oracle-5.3, linux-raspi2, linux-raspi2-5.3 vulnerabilities
linux, linux-aws, linux-azure, linux-azure-5.3, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-oracle-5.3, linux-raspi2, linux-raspi2-5.3 vulnerabilities
Al Viro discovered that the Linux kernel for s390x systems did not properly
perform page table upgrades for kernel sections that use secondary address
mode. A local attacker could use this to cause a denial of service (system
crash) or execute arbitrary code. (CVE-2020-11884)
It was discovered that the Intel Wi-Fi driver in the Linux kernel did not
properly check for errors in some situations. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2019-16234)
Tristan Madani discovered that the block I/O tracing implementation in the
Linux kernel contained a race co
OSV
CVE-2020-11884: In the Linux kernel 4
osv·2020-04-29·CVSS 7.0
CVE-2020-11884 [HIGH] CVE-2020-11884: In the Linux kernel 4
In the Linux kernel 4.19 through 5.6.7 on the s390 platform, code execution may occur because of a race condition, as demonstrated by code in enable_sacf_uaccess in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade, aka CID-3f777e19d171. A crash could also occur.
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2020-04-28·CVSS 4.7
CVE-2020-11884 [MEDIUM] linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
Al Viro discovered that the Linux kernel for s390x systems did not properly
perform page table upgrades for kernel sections that use secondary address
mode. A local attacker could use this to cause a denial of service (system
crash) or execute arbitrary code. (CVE-2020-11884)
It was discovered that the Intel Wi-Fi driver in the Linux kernel did not
properly check for errors in some situations. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2019-16234)
Tristan Madani discovered that the block I/O tracing implementation in the
Linux kernel contained a race condition. A local attack
Kernel
Merge tag 'cve-2020-11884' from emailed bundle
kernel_security·2020-04-28·CVSS 7.0
CVE-2020-11884 [HIGH] Merge tag 'cve-2020-11884' from emailed bundle
Merge tag 'cve-2020-11884' from emailed bundle
Pull s390 fix from Christian Borntraeger:
"Fix a race between page table upgrade and uaccess on s390.
This fixes CVE-2020-11884 which allows for a local kernel crash or
code execution"
* tag 'cve-2020-11884' from emailed bundle:
s390/mm: fix page table upgrade vs 2ndary address mode accesses
Kernel
s390/mm: fix page table upgrade vs 2ndary address mode accesses
kernel_security·2020-04-15
CVE-2020-11884 s390/mm: fix page table upgrade vs 2ndary address mode accesses
s390/mm: fix page table upgrade vs 2ndary address mode accesses
A page table upgrade in a kernel section that uses secondary address
mode will mess up the kernel instructions as follows:
Consider the following scenario: two threads are sharing memory.
On CPU1 thread 1 does e.g. strnlen_user(). That gets to
old_fs = enable_sacf_uaccess();
len = strnlen_user_srst(src, size);
and
" la %2,0(%1)\n"
" la %3,0(%0,%1)\n"
" slgr %0,%0\n"
" sacf 256\n"
"0: srst %3,%2\n"
in strnlen_user_srst(). At that point we are in secondary space mode,
control register 1 points to kernel page table and instruction fetching
happens via c1, rather than usual c13. Interrupts are not disabled, for
obvious reasons.
On CPU2 thread 2 does MAP_FIXED mmap(), forcing the upgrade of page table
from 3-level to e.g. 4-leve
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-11884 kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation [fedora-all]
bugzilla·2020-04-29·CVSS 7.0
CVE-2020-11884 [HIGH] CVE-2020-11884 kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation [fedora-all]
CVE-2020-11884 kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this
Bugzilla
CVE-2020-11884 Kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation
bugzilla·2020-04-27·CVSS 7.0
CVE-2020-11884 [HIGH] CVE-2020-11884 Kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation
CVE-2020-11884 Kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation
An issue was found in the way Linux kernel on s390 architecture upgrades page table and updates corresponding addresses in CPU's control registers. The issue occurs on multiprocessing system, when one s390 CPU is in Secondary Address Mode and another CPU does kernel page table upgrade. It leads to Inter Processor Interrupts (IPI) being sent to each active CPU, for it to update its control register(s) with new page table address(es). In the Secondary Address Mode, CPU's CR1 register may hold kernel space address to fetch instruction from. But after the IPI processing, the same CR1 register is set to point to a user space address.
An unprivileged user/process on s390 system may use th
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=215d1f3928713d6eaec67244bcda72105b898000https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3f777e19d171670ab558a6d5e6b1ac7f9b6c574fhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TZBP2HINNAX7HKHCOUMIFVQPV6GWMCZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQUVKC3IPUC5B374VVAZV4J5P3GAUGSW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKVJMS4GQRH5SO35WM5GINCFAGXQ3ZW6/https://security.netapp.com/advisory/ntap-20200608-0001/https://usn.ubuntu.com/4342-1/https://usn.ubuntu.com/4343-1/https://usn.ubuntu.com/4345-1/https://www.debian.org/security/2020/dsa-4667https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=215d1f3928713d6eaec67244bcda72105b898000https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3f777e19d171670ab558a6d5e6b1ac7f9b6c574fhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TZBP2HINNAX7HKHCOUMIFVQPV6GWMCZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQUVKC3IPUC5B374VVAZV4J5P3GAUGSW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKVJMS4GQRH5SO35WM5GINCFAGXQ3ZW6/https://security.netapp.com/advisory/ntap-20200608-0001/https://usn.ubuntu.com/4342-1/https://usn.ubuntu.com/4343-1/https://usn.ubuntu.com/4345-1/https://www.debian.org/security/2020/dsa-4667
2020-04-29
Published