CVE-2020-12114: Race Condition

Published May 4, 2020
·
Updated

A flaw was found in the Linux kernel’s implementation of the pivotroot syscall. This flaw allows a local privileged user (root outside or root inside a privileged container) to exploit a race condition to manipulate the reference count of the root filesystem. To be able to abuse this flaw, the process or user calling pivotroot must have advanced permissions. The highest threat from this vulnerability is to system availability.

Other sources

A flaw was found in the Linux kernels implementation of the pivotroot syscall. A local privileged user (root outside or root inside a privileged container) could exploit a race condition to manipulate the reference count of the root filesystem.

To be able to abuse this flaw, the process or user calling pivotroot must have advanced permissions. As quoted from the pivotroot(2) man page:

The calling process must have the CAPSYSADMIN capability in the user namespace that owns the caller's mount namespace.

This can allow any user able to execute the pivotroot to cause a denial of service (panic) by corrupting a mountpoint reference counter, possibly allowing for a container escape.

References: http://seclists.org/oss-sec/2020/q2/86 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.14.178&id=e21c8c03af20932c15d8b1d3bb9cbad9607a6eab https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.4.221&id=83354adbd7a967230bd23a547c5b695567ddba2c https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.19.119&id=f511dc75d22e0c000fc70b54f670c2c17f5fba9a https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v4.9.221&id=91e997939dda1a866f23ddfb043dcd4a3ff57524

— Red Hat

A pivotroot race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x before 4.14.178, 4.19.x before 4.19.119, and 5.x before 5.3 allows local users to cause a denial of service (panic) by corrupting a mountpoint reference counter.

— Ubuntu

Affected Software

10 affected componentsFixes available
redhat/kernel-rt<0:4.18.0-305.rt7.72.el8
0:4.18.0-305.rt7.72.el8
redhat/kernel<0:4.18.0-305.el8
0:4.18.0-305.el8
redhat/kernel-rt<0:4.18.0-193.56.1.rt13.106.el8_2
0:4.18.0-193.56.1.rt13.106.el8_2
redhat/kernel<0:4.18.0-193.56.1.el8_2
0:4.18.0-193.56.1.el8_2
Linux Linux kernel>=4.4.0<4.4.221
Linux Linux kernel>=4.9.0<4.9.221
Linux Linux kernel>=4.14<4.14.178
Linux Linux kernel>=4.19<4.19.119
Linux Linux kernel>=5.0<5.3
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-305.rt7.72.el8
  2. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-305.el8
  3. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-193.56.1.rt13.106.el8_2
  4. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-193.56.1.el8_2
  5. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
  6. Upgrade

    Upgrade Linux kernel 4.4.x to a version that resolves this vulnerability.

    Fixed in 4.4.221
  7. Upgrade

    Upgrade Linux kernel 4.9.x to a version that resolves this vulnerability.

    Fixed in 4.9.221
  8. Upgrade

    Upgrade Linux kernel 4.14.x to a version that resolves this vulnerability.

    Fixed in 4.14.178
  9. Upgrade

    Upgrade Linux kernel 4.19.x to a version that resolves this vulnerability.

    Fixed in 4.19.119
  10. Upgrade

    Upgrade Linux kernel 5.x to a version that resolves this vulnerability.

    Fixed in 5.3

Event History

May 4, 2020
CVE Published
12:00 AM
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·11:42 AM
Data Sourced
via MITRE·11:42 AM
Description
Data Sourced
via NVD·12:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jun 18, 2020
Data Sourced
via Red Hat·05:03 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2020-12114?

CVE-2020-12114 is considered a medium severity vulnerability due to its local privilege escalation potential.

2

How do I fix CVE-2020-12114?

To fix CVE-2020-12114, update to the patched versions of the Linux kernel as specified by your distribution, such as kernel version 0:4.18.0-305.rt7.72.el8 or later.

3

Who is affected by CVE-2020-12114?

CVE-2020-12114 affects local privileged users, including those in privileged containers on Linux systems.

4

What type of vulnerability is CVE-2020-12114?

CVE-2020-12114 is a local privilege escalation vulnerability in the Linux kernel's pivot_root syscall.

5

What versions of the Linux kernel are affected by CVE-2020-12114?

The affected versions range from kernel versions 4.4.0 to 5.3 and specific versions such as 0:4.18.0-193.el8.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203