CVE-2020-29372: Race Condition
First published: Sat Nov 28 2020(Updated: )
An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORING_OP_MADVISE implementation, aka CID-bc0c4d1e176e.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux kernel | <5.6.8 | |
| Ubuntu Linux | =14.04 | |
| Ubuntu Linux | =16.04 | |
| Ubuntu Linux | =18.04 | |
| Ubuntu Linux | =20.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2029
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.8
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0c4d1e176eeb614dc8734fc3ace34292771f11
Frequently Asked Questions
What is the severity of CVE-2020-29372?
CVE-2020-29372 has a medium severity rating due to the potential for a race condition leading to unexpected behavior during coredump operations.
How do I fix CVE-2020-29372?
To fix CVE-2020-29372, update your Linux kernel to version 5.6.8 or later.
Which versions of Linux are affected by CVE-2020-29372?
CVE-2020-29372 affects the Linux kernel versions before 5.6.8 and specific Ubuntu versions including 14.04, 16.04, 18.04, and 20.04.
What components are involved in the CVE-2020-29372 vulnerability?
The vulnerability involves a race condition in the do_madvise function within the Linux kernel during IORING_OP_MADVISE operations.
Is CVE-2020-29372 related to any other vulnerabilities?
CVE-2020-29372 is associated with a specific implementation issue in the Linux kernel that can occur during concurrent operations.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/remedy
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/linux
- canonical/linux kernel
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/14.04
- version/ubuntu/16.04
- version/ubuntu/18.04
- version/ubuntu/20.04