CVE-2020-11884: Race Condition
First published: Mon Apr 27 2020(Updated: )
A flaw was found in the Linux kernel on s390 architecture. The issue occurs on multiprocessing systems when one s390 CPU is in Secondary Address Mode and another CPU does a kernel page table upgrade. An inter-processor interrupt (IPI) is then sent to each active CPU to update the control registers with new page table addresses. In Secondary Address Mode the CPU's CR1 register may hold kernel space address to fetch instructions from, but after IPI processing, the same CR1 register is set to point to a user space address. An unprivileged user or process on the system may use this flaw to crash the system or escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel | <0:4.18.0-193.1.2.el8_2 | 0:4.18.0-193.1.2.el8_2 |
| redhat/kernel | <0:4.18.0-80.23.2.el8_0 | 0:4.18.0-80.23.2.el8_0 |
| redhat/kernel | <0:4.18.0-147.13.2.el8_1 | 0:4.18.0-147.13.2.el8_1 |
| redhat/kernel | <5.7 | 5.7 |
| Linux Linux kernel | >=4.15<4.19.119 | |
| Linux Linux kernel | >=4.20<5.4.36 | |
| Linux Linux kernel | >=5.5<5.6.8 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =18.04 | |
| Canonical Ubuntu Linux | =19.10 | |
| Canonical Ubuntu Linux | =20.04 | |
| Debian Debian Linux | =10.0 | |
| Fedoraproject Fedora | =30 | |
| Fedoraproject Fedora | =31 | |
| Fedoraproject Fedora | =32 | |
| Netapp Active Iq Unified Manager Vmware Vsphere | ||
| Netapp Cloud Backup | ||
| Netapp Element Software | ||
| Netapp Hci Management Node | ||
| Netapp Solidfire | ||
| Netapp Steelstore Cloud Integrated Storage | ||
| Netapp Solidfire Baseboard Management Controller | ||
| All of | ||
| Netapp Bootstrap Os | ||
| Netapp Hci Compute Node | ||
| All of | ||
| Netapp A700s Firmware | ||
| Netapp A700s | ||
| All of | ||
| Netapp H300s Firmware | ||
| Netapp H300s | ||
| All of | ||
| Netapp H500s Firmware | ||
| Netapp H500s | ||
| All of | ||
| Netapp H700s Firmware | ||
| Netapp H700s | ||
| All of | ||
| Netapp H300e Firmware | ||
| Netapp H300e | ||
| All of | ||
| Netapp H500e Firmware | ||
| Netapp H500e | ||
| All of | ||
| Netapp H700e Firmware | ||
| Netapp H700e | ||
| All of | ||
| Netapp H410s Firmware | ||
| Netapp H410s | ||
| All of | ||
| Netapp H410c Firmware | ||
| Netapp H410c | ||
| All of | ||
| Netapp H610c Firmware | ||
| Netapp H610c | ||
| All of | ||
| Netapp H610s Firmware | ||
| Netapp H610s | ||
| Netapp Bootstrap Os | ||
| Netapp Hci Compute Node | ||
| Netapp A700s Firmware | ||
| Netapp A700s | ||
| Netapp H300s Firmware | ||
| Netapp H300s | ||
| Netapp H500s Firmware | ||
| Netapp H500s | ||
| Netapp H700s Firmware | ||
| Netapp H700s | ||
| Netapp H300e Firmware | ||
| Netapp H300e | ||
| Netapp H500e Firmware | ||
| Netapp H500e | ||
| Netapp H700e Firmware | ||
| Netapp H700e | ||
| Netapp H410s Firmware | ||
| Netapp H410s | ||
| Netapp H410c Firmware | ||
| Netapp H410c | ||
| Netapp H610c Firmware | ||
| Netapp H610c | ||
| Netapp H610s Firmware | ||
| Netapp H610s | ||
| debian/linux | 5.10.223-1 5.10.226-1 6.1.106-3 6.1.112-1 6.11.4-1 6.11.5-1 |
Remedy
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-11884 https://nvd.nist.gov/vuln/detail/CVE-2020-11884
- https://bugzilla.redhat.com/show_bug.cgi?id=1828149
- https://access.redhat.com/errata/RHSA-2020:2102
- https://access.redhat.com/errata/RHSA-2020:2429
- https://access.redhat.com/errata/RHSA-2020:2199
- https://access.redhat.com/security/cve/cve-2020-11884
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3f777e19d171670ab558a6d5e6b1ac7f9b6c574f
- https://www.debian.org/security/2020/dsa-4667
- https://usn.ubuntu.com/4343-1/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AQUVKC3IPUC5B374VVAZV4J5P3GAUGSW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKVJMS4GQRH5SO35WM5GINCFAGXQ3ZW6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TZBP2HINNAX7HKHCOUMIFVQPV6GWMCZ/
- https://usn.ubuntu.com/4345-1/
- https://usn.ubuntu.com/4342-1/
- https://security.netapp.com/advisory/ntap-20200608-0001/
- https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=215d1f3928713d6eaec67244bcda72105b898000
- https://launchpad.net/bugs/cve/CVE-2020-11884
- https://git.kernel.org/linus/316ec154810960052d4586b634156c54d0778f74
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1829181
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TZBP2HINNAX7HKHCOUMIFVQPV6GWMCZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQUVKC3IPUC5B374VVAZV4J5P3GAUGSW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKVJMS4GQRH5SO35WM5GINCFAGXQ3ZW6/
- https://security-tracker.debian.org/tracker/CVE-2020-11884
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11884
- https://nvd.nist.gov/vuln/detail/CVE-2020-11884
- https://ubuntu.com/security/CVE-2020-11884
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-11884.
What is the severity of CVE-2020-11884?
The severity of CVE-2020-11884 is high with a severity value of 7.
How does CVE-2020-11884 occur?
CVE-2020-11884 occurs on multiprocessing systems when one s390 CPU is in Secondary Address Mode and another CPU does a kernel page table upgrade.
What is the affected software for CVE-2020-11884?
The affected software includes Linux kernels 4.19 through 5.6.7 on the s390 platform.
Is there a fix for CVE-2020-11884?
Yes, there are remediation steps available for CVE-2020-11884. Please refer to the references for more information.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/weakness
- agent/severity
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-11884
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-api
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- collector/security-tracker-debian
- source/Debian
- agent/remedy
- agent/references
- agent/tags
- agent/softwarecombine
- agent/event
- agent/description
- package-manager/redhat
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/4.15
- version/linux linux kernel/4.20
- version/linux linux kernel/5.5
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/18.04
- version/canonical ubuntu linux/19.10
- version/canonical ubuntu linux/20.04
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/30
- version/fedoraproject fedora/31
- version/fedoraproject fedora/32
- vendor/netapp
- canonical/netapp active iq unified manager vmware vsphere
- canonical/netapp cloud backup
- canonical/netapp element software
- canonical/netapp hci management node
- canonical/netapp solidfire
- canonical/netapp steelstore cloud integrated storage
- canonical/netapp solidfire baseboard management controller
- canonical/netapp bootstrap os
- canonical/netapp hci compute node
- canonical/netapp a700s firmware
- canonical/netapp a700s
- canonical/netapp h300s firmware
- canonical/netapp h300s
- canonical/netapp h500s firmware
- canonical/netapp h500s
- canonical/netapp h700s firmware
- canonical/netapp h700s
- canonical/netapp h300e firmware
- canonical/netapp h300e
- canonical/netapp h500e firmware
- canonical/netapp h500e
- canonical/netapp h700e firmware
- canonical/netapp h700e
- canonical/netapp h410s firmware
- canonical/netapp h410s
- canonical/netapp h410c firmware
- canonical/netapp h410c
- canonical/netapp h610c firmware
- canonical/netapp h610c
- canonical/netapp h610s firmware
- canonical/netapp h610s
- package-manager/debian