CVE-2020-29374

low
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58.

References

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.3

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=17839856fd588f4ab6b789f482ed3ffd7c403e1f

https://bugs.chromium.org/p/project-zero/issues/detail?id=2045

https://security.netapp.com/advisory/ntap-20210115-0002/

http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html

https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html

https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html

Details

Source: MITRE

Published: 2020-11-28

Updated: 2021-07-13

Type: CWE-362

Risk Information

CVSS v2

Base Score: 3.3

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:N

Impact Score: 4.9

Exploitability Score: 3.4

Severity: LOW

CVSS v3

Base Score: 3.6

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Impact Score: 2.5

Exploitability Score: 1

Severity: LOW

Tenable Plugins

View all (15 total)

IDNameProductFamilySeverity
150985Debian DLA-2689-1 : linux security updateNessusDebian Local Security Checks
high
150984Debian DLA-2690-1 : linux-4.19 security updateNessusDebian Local Security Checks
high
149872Amazon Linux AMI : kernel (ALAS-2021-1503)NessusAmazon Linux Local Security Checks
high
149870Amazon Linux 2 : kernel (ALAS-2021-1636)NessusAmazon Linux Local Security Checks
high
148700SUSE SLES12 Security Update : kernel (SUSE-SU-2021:1210-1)NessusSuSE Local Security Checks
high
148509SUSE SLES12 Security Update : kernel (SUSE-SU-2021:1175-1)NessusSuSE Local Security Checks
medium
147983Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4749-1)NessusUbuntu Local Security Checks
high
147975Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4748-1)NessusUbuntu Local Security Checks
high
147591SUSE SLES15 Security Update : kernel (SUSE-SU-2021:0735-1)NessusSuSE Local Security Checks
high
147586SUSE SLES15 Security Update : kernel (SUSE-SU-2021:0740-1)NessusSuSE Local Security Checks
high
147579SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2021:0741-1)NessusSuSE Local Security Checks
high
147568SUSE SLES12 Security Update : kernel (SUSE-SU-2021:0736-1)NessusSuSE Local Security Checks
high
147563openSUSE Security Update : the Linux Kernel (openSUSE-2021-393)NessusSuSE Local Security Checks
high
147464SUSE SLES15 Security Update : kernel (SUSE-SU-2021:0737-1)NessusSuSE Local Security Checks
high
144731EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2021-1039)NessusHuawei Local Security Checks
high