An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/hugememory.c. The getuser_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58.
[
{
"target": {
"file": "mm/gup.c",
"function": "internal_get_user_pages_fast"
},
"id": "CVE-2020-29374-290daff8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@17839856fd588f4ab6b789f482ed3ffd7c403e1f",
"digest": {
"length": 873.0,
"function_hash": "323879688725331999498444677361153014233"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"file": "mm/gup.c"
},
"id": "CVE-2020-29374-43b86b3a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@17839856fd588f4ab6b789f482ed3ffd7c403e1f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"174976490296946991246910277352102408256",
"244294158023364689983675256562614999810",
"80615053076251239769930300325208135444",
"57170684908740387172301021707914018345",
"257952295658745104923910458787775428265",
"278846859602014634913390169143373603383",
"179533537749381961794230495007146899963",
"328378694140903536589676389307498063010",
"274432487139958405702893068273075187953",
"214438643548237675683311928681715806787",
"315417227101848360375116881730912800699",
"48047593146948675454976647461453380853",
"238598341512853016882059856721470122842",
"43009068416818630533983324242782178614",
"51115585563120211361192828290020388836",
"229775904767502691676820898904917182855",
"245788646849712757263769463415113672550",
"209791104305673750527845675522338646552",
"223176870461756529715843356909920811256",
"243854175057511934298961746738395030129",
"126230026502210687560287269242217299514",
"84249344745785425501883823569362456573",
"23819077534910201360806390356119395020",
"306757330430440958120434920063734815454",
"55032739140385669917955147191959873036",
"75903480179494580751448343434303954466",
"130995343249546601802277297481267068961",
"330476163437731284196900105753432037423",
"246081370125594904255358430383917657177",
"50203913314268303740113016615302880666",
"182867908146161411378661934773928993991"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"file": "mm/gup.c",
"function": "__get_user_pages"
},
"id": "CVE-2020-29374-4b58aaff",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@17839856fd588f4ab6b789f482ed3ffd7c403e1f",
"digest": {
"length": 2038.0,
"function_hash": "91203271834135273316609377118534290573"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"file": "mm/gup.c",
"function": "can_follow_write_pte"
},
"id": "CVE-2020-29374-9485517d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@17839856fd588f4ab6b789f482ed3ffd7c403e1f",
"digest": {
"length": 175.0,
"function_hash": "22854469281736808529659055724496481259"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"target": {
"file": "mm/huge_memory.c"
},
"id": "CVE-2020-29374-9fb3cfa1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@17839856fd588f4ab6b789f482ed3ffd7c403e1f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"129349296596538685714957343908531318991",
"237960060259730149600909533440410807404",
"237707147744413447061047142705619213354",
"172488912318125651845608753638689648510",
"71703894152171452744817867738910319369",
"14766279862144987663834380081429099604",
"64405655513103782727341669476966651083"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"file": "mm/huge_memory.c",
"function": "can_follow_write_pmd"
},
"id": "CVE-2020-29374-d47ec2a1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@17839856fd588f4ab6b789f482ed3ffd7c403e1f",
"digest": {
"length": 175.0,
"function_hash": "22854469281736808529659055724496481259"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-29374.json"