CVE-2020-11884: Race Condition
A flaw was found in the Linux kernel on s390 architecture. The issue occurs on multiprocessing systems when one s390 CPU is in Secondary Address Mode and another CPU does a kernel page table upgrade. An inter-processor interrupt (IPI) is then sent to each active CPU to update the control registers with new page table addresses. In Secondary Address Mode the CPU's CR1 register may hold kernel space address to fetch instructions from, but after IPI processing, the same CR1 register is set to point to a user space address. An unprivileged user or process on the system may use this flaw to crash the system or escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
An issue was found in the way Linux kernel on s390 architecture upgrades page table and updates corresponding addresses in CPU's control registers. The issue occurs on multiprocessing system, when one s390 CPU is in Secondary Address Mode and another CPU does kernel page table upgrade. It leads to Inter Processor Interrupts (IPI) being sent to each active CPU, for it to update its control register(s) with new page table address(es). In the Secondary Address Mode, CPU's CR1 register may hold kernel space address to fetch instruction from. But after the IPI processing, the same CR1 register is set to point to a user space address.
An unprivileged user/process on s390 system may use this flaw to crash the system resulting in DoS OR potentially escalate privileges on the system.
Upstream patch: --------------- -> https://git.kernel.org/linus/316ec154810960052d4586b634156c54d0778f74
— Red Hat
In the Linux kernel 4.19 through 5.6.7 on the s390 platform, code execution may occur because of a race condition, as demonstrated by code in enablesacfuaccess in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade, aka CID-3f777e19d171. A crash could also occur.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.1.2.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-80.23.2.el8_0 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.13.2.el8_1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.7-1Fixed in 7.1.8-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-11884.
What is the severity of CVE-2020-11884?
The severity of CVE-2020-11884 is high with a severity value of 7.
How does CVE-2020-11884 occur?
CVE-2020-11884 occurs on multiprocessing systems when one s390 CPU is in Secondary Address Mode and another CPU does a kernel page table upgrade.
What is the affected software for CVE-2020-11884?
The affected software includes Linux kernels 4.19 through 5.6.7 on the s390 platform.
Is there a fix for CVE-2020-11884?
Yes, there are remediation steps available for CVE-2020-11884. Please refer to the references for more information.