CVE-2020-29372 — Race Condition in Kernel

CWE-362 — Race ConditionCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer8 documents8 sources
Severity
4.7MEDIUMNVD
EPSS
0.1%
top 81.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Linux KernelCanonical Ubuntu Linux
Timeline
PublishedNov 28
Latest updateMay 24

Description

An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORING_OP_MADVISE implementation, aka CID-bc0c4d1e176e.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.0 | Impact: 3.6

Affected Packages2 packages

▶NVDlinux/linux_kernel< 5.6.8
▶Debianlinux/linux_kernel< 5.6.14-1+3

Also affects: Ubuntu Linux 14.04, 16.04, 18.04, 20.04

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-w2fw-m3gj-2pvm: An issue was discovered in do_madvise in mm/madvise↗2022-05-24
▶
OSV
CVE-2020-29372: An issue was discovered in do_madvise in mm/madvise↗2020-11-28
▶
CVEList
CVE-2020-29372: An issue was discovered in do_madvise in mm/madvise↗2020-11-28
▶

📋Vendor Advisories

3
Microsoft
An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORING_OP_MADVISE implementation aka CID-bc0c4d1e1↗2020-11-10
▶
Red Hat
kernel: IORING_OP_MADVISE races with coredumping↗2020-07-23
▶
Debian
CVE-2020-29372: linux - An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before...↗2020
▶

💬Community

1
Bugzilla
CVE-2020-29372 kernel: IORING_OP_MADVISE races with coredumping↗2020-09-01
▶
CVE-2020-29372 — Race Condition in Linux Kernel | cvebase