CVE-2020-29374
published 2020-11-28CVE-2020-29374: An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for…
PriorityP414low3.6CVSS 3.1
AVLACHPRLUINSUCLILAN
EPSS
0.40%
33.1th percentile
An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 5.7.6-1 (bookworm) | linux 5.7.6-1 (bookworm) |
| android | — | — | |
| chrome_chrome | — | — | |
| linux | linux_kernel | < 5.7.3 | 5.7.3 |
| linux | linux_kernel | >= 0 < 5.7.6-1 | 5.7.6-1 |
| linux | linux_kernel | >= 0 < 5.7.6-1 | 5.7.6-1 |
| linux | linux_kernel | >= 0 < 5.7.6-1 | 5.7.6-1 |
| linux | linux_kernel | >= 0 < 5.7.6-1 | 5.7.6-1 |
| linux | linux_kernel | >= 0 < 4.4.0-203.235 | 4.4.0-203.235 |
| linux | linux_kernel | >= 0 < 4.15.0-136.140 | 4.15.0-136.140 |
| msrc | cm1_kernel_5.4.91-1_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.13.6LOWCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
nvdv2.03.3LOWAV:L/AC:M/Au:N/C:P/I:P/A:N
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian3.6LOW
vendor_msrc3.6LOW
vendor_redhat3.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2020-29374: In multiple locations, there is a possible out of bounds write due to a race condition
osv·2023-08-01
CVE-2020-29374 CVE-2020-29374: In multiple locations, there is a possible out of bounds write due to a race condition
In multiple locations, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
GHSA
GHSA-7jw3-9qpg-fmp6: An issue was discovered in the Linux kernel before 5
ghsa_unreviewed·2022-05-24
CVE-2020-29374 [HIGH] CWE-362 GHSA-7jw3-9qpg-fmp6: An issue was discovered in the Linux kernel before 5
An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58.
Kernel
mm/huge_memory: streamline COW logic in do_huge_pmd_wp_page()
kernel_security·2022-03-24·CVSS 3.6
CVE-2020-29374 [LOW] mm/huge_memory: streamline COW logic in do_huge_pmd_wp_page()
mm/huge_memory: streamline COW logic in do_huge_pmd_wp_page()
We currently have a different COW logic for anon THP than we have for
ordinary anon pages in do_wp_page(): the effect is that the issue reported
in CVE-2020-29374 is currently still possible for anon THP: an unintended
information leak from the parent to the child.
Let's apply the same logic (page_count() == 1), with similar optimizations
to remove additional references first as we really want to avoid
PTE-mapping the THP and copying individual pages best we can.
If we end up with a page that has page_count() != 1, we'll have to PTE-map
the THP and fallback to do_wp_page(), which will always copy the page.
Note that KSM does not apply to THP.
I. Interaction with the swapcache and writeback
While a THP is in the swapcache,
Kernel
mm: streamline COW logic in do_swap_page()
kernel_security·2022-03-24·CVSS 3.6
CVE-2020-29374 [LOW] mm: streamline COW logic in do_swap_page()
mm: streamline COW logic in do_swap_page()
Currently we have a different COW logic when:
* triggering a read-fault to swapin first and then trigger a write-fault
-> do_swap_page() + do_wp_page()
* triggering a write-fault to swapin
-> do_swap_page() + do_wp_page() only if we fail reuse in do_swap_page()
The COW logic in do_swap_page() is different than our reuse logic in
do_wp_page(). The COW logic in do_wp_page() -- page_count() == 1 -- makes
currently sure that we certainly don't have a remaining reference, e.g.,
via GUP, on the target page we want to reuse: if there is any unexpected
reference, we have to copy to avoid information leaks.
As do_swap_page() behaves differently, in environments with swap enabled
we can currently have an unintended information leak from the parent to
the
Kernel
mm: optimize do_wp_page() for exclusive pages in the swapcache
kernel_security·2022-03-24·CVSS 3.6
CVE-2020-29374 [LOW] mm: optimize do_wp_page() for exclusive pages in the swapcache
mm: optimize do_wp_page() for exclusive pages in the swapcache
Patch series "mm: COW fixes part 1: fix the COW security issue for THP and swap", v3.
This series attempts to optimize and streamline the COW logic for ordinary
anon pages and THP anon pages, fixing two remaining instances of
CVE-2020-29374 in do_swap_page() and do_huge_pmd_wp_page(): information
can leak from a parent process to a child process via anonymous pages
shared during fork().
This issue, including other related COW issues, has been summarized in [2]:
"1. Observing Memory Modifications of Private Pages From A Child Process
Long story short: process-private memory might not be as private as you
think once you fork(): successive modifications of private memory
regions in the parent process can still be observed by
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
osv·2021-02-25·CVSS 7.8
CVE-2020-27815 [HIGH] linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
It was discovered that the memory management subsystem in the Linux kernel
did not properly handle copy-on-write operations in some situations. A
local attacker could possibly use this to gain unintended write access to
read-only memory pages. (CVE-2020-29374)
Michael Kurth and Pawel Wieczorkiewicz discovered that the Xen event
processing backend in the Linux kernel did not properly limit the number of
events queued. An attacker in a guest VM could use this to cause a de
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabil
osv·2021-02-25·CVSS 7.8
CVE-2020-25669 [HIGH] linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabil
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in
the Linux kernel did not correctly handle setting line discipline in s
OSV
CVE-2020-29374: An issue was discovered in the Linux kernel before 5
osv·2020-11-28·CVSS 3.6
CVE-2020-29374 [LOW] CVE-2020-29374: An issue was discovered in the Linux kernel before 5
An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58.
Chrome
Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2023-4367
vendor_chrome·2023-08-25·CVSS 3.6
CVE-2023-4367 [MEDIUM] Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2023-4367
Stable Channel Update for ChromeOS / ChromeOS Flex
CVE-2023-4367: Insufficient policy enforcement in Extensions API. Reported by Axel Chong on 2023-07-26 [$500][ 1467751 ] Medium CVE-2023-4368: Insufficient policy enforcement in Extensions API
Reported by Axel Chong on 2023-07-26 Android Runtime Container Security Fixes: [NA] [NA] High Fixes CVE-2023-21264 on impacted platforms [NA] [NA] High Fixes CVE-2020-29374 on impacted platforms We would like to thank the security researchers that report vulnerabilities to us via bughunters
Severity: medium
Android
CVE-2020-29374: COW
vendor_android·2023-08-01·CVSS 3.6
CVE-2020-29374 [LOW] CVE-2020-29374: COW
Android Security Bulletin 2023-08-01
CVE: CVE-2020-29374
Severity: HIGH
Type: EoP
Component: COW
References: A-174737879
Upstream kernel
[2]
[3]
[4]
[5]
[6]
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-02-25·CVSS 7.8
CVE-2020-29660 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
It was discovered that the memory management subsystem in the Linux kernel
did not properly handle copy-on-write operations in some situations. A
local attacker could possibly use this to gain unintended write access to
read-only memory pages. (CVE-2020-29374)
Michael Kurth and Pawel Wieczorkiewicz discovered that the Xen event
processing backend in the Linux kernel did not properly limit the number of
events queued. An attacker in a guest VM could use this to ca
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2021-02-25·CVSS 7.8
CVE-2020-27815 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Bodong Zhao discovered a use-after-free in the Sun keyboard driver
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service or possibly execute arbitrary code.
(CVE-2020-25669)
It was discovered that the jfs file system implementation in the Linux
kernel contained an out-of-bounds read vulnerability. A local attacker
could use this to possibly cause a denial of service (system crash).
(CVE-2020-27815)
Shisong Qin and Bodong Zhao discovered that Speakup screen reader driver in
the Linux kernel did not correctly handle setting line discipline in some
situations. A local attacker could use this to cause a denial of service
(system crash). (CVE-2020-2
Microsoft
An issue was discovered in the Linux kernel before 5.7.3 related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation when used for a copy-on-write page does not properly cons
vendor_msrc·2020-11-10·CVSS 3.6
CVE-2020-29374 [LOW] CWE-362 An issue was discovered in the Linux kernel before 5.7.3 related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation when used for a copy-on-write page does not properly cons
An issue was discovered in the Linux kernel before 5.7.3 related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation when used for a copy-on-write page does not properly consider the semantics of read operations and therefore can grant unintended write access aka CID-17839856fd58.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025.
Red Hat
kernel: the get_user_pages implementation when used for a copy-on-write page does not properly consider the semantics of read operations and therefore can grant unintended read access
vendor_redhat·2020-06-02·CVSS 3.6
CVE-2020-29374 [LOW] CWE-362 kernel: the get_user_pages implementation when used for a copy-on-write page does not properly consider the semantics of read operations and therefore can grant unintended read access
kernel: the get_user_pages implementation when used for a copy-on-write page does not properly consider the semantics of read operations and therefore can grant unintended read access
An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58.
An issue was discovered in the Linux kernel related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended read access.
Statement: This issue was
Debian
CVE-2020-29374: linux - An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c an...
vendor_debian·2020·CVSS 3.6
CVE-2020-29374 [LOW] CVE-2020-29374: linux - An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c an...
An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58.
Scope: local
bookworm: resolved (fixed in 5.7.6-1)
bullseye: resolved (fixed in 5.7.6-1)
forky: resolved (fixed in 5.7.6-1)
sid: resolved (fixed in 5.7.6-1)
trixie: resolved (fixed in 5.7.6-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.htmlhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2045https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.3https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=17839856fd588f4ab6b789f482ed3ffd7c403e1fhttps://lists.debian.org/debian-lts-announce/2021/06/msg00019.htmlhttps://lists.debian.org/debian-lts-announce/2021/06/msg00020.htmlhttps://lists.debian.org/debian-lts-announce/2022/03/msg00012.htmlhttps://security.netapp.com/advisory/ntap-20210115-0002/https://www.debian.org/security/2022/dsa-5096http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.htmlhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2045https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.3https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=17839856fd588f4ab6b789f482ed3ffd7c403e1fhttps://lists.debian.org/debian-lts-announce/2021/06/msg00019.htmlhttps://lists.debian.org/debian-lts-announce/2021/06/msg00020.htmlhttps://lists.debian.org/debian-lts-announce/2022/03/msg00012.htmlhttps://security.netapp.com/advisory/ntap-20210115-0002/https://www.debian.org/security/2022/dsa-5096
2020-11-28
Published