Race condition in Linux kernel - CVE-2020-12114

Vulnerability identifier: #VU27480

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12114

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to a race condition between threads updating mountpoint reference counter. A local user can exploit the race and crash the system.

Linux kernel
Anolis OS
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux Server - TUS
kernel-rt (Red Hat package)
kernel (Red Hat package)
kernel-debug-modules-extra
kernel-doc
kernel-abi-whitelists
python3-perf
perf
kernel-tools-libs
kernel-tools
kernel-modules-extra
kernel-modules
kernel-headers
kernel-devel
kernel-debug-modules
kernel-debug-devel
kernel-debug-core
kernel-debug
kernel-cross-headers
kernel-core
kernel
bpftool

Install update from vendor's website.

Linux kernel - addressed in versions 4.4.221, 4.9.221, 4.14.178, 4.19.119
kernel-rt (Red Hat package) - update to 4.18.0-193.56.1.rt13.106.el8_2
kernel (Red Hat package) - update to 4.18.0-193.56.1.el8_2
kernel-debug-modules-extra - update to 4.18.0-193.56.1
kernel-doc - update to 4.18.0-193.56.1
kernel-abi-whitelists - update to 4.18.0-193.56.1
python3-perf - update to 4.18.0-193.56.1
perf - update to 4.18.0-193.56.1
kernel-tools-libs - update to 4.18.0-193.56.1
kernel-tools - update to 4.18.0-193.56.1
kernel-modules-extra - update to 4.18.0-193.56.1
kernel-modules - update to 4.18.0-193.56.1
kernel-headers - update to 4.18.0-193.56.1
kernel-devel - update to 4.18.0-193.56.1
kernel-debug-modules - update to 4.18.0-193.56.1
kernel-debug-devel - update to 4.18.0-193.56.1
kernel-debug-core - update to 4.18.0-193.56.1
kernel-debug - update to 4.18.0-193.56.1
kernel-cross-headers - update to 4.18.0-193.56.1
kernel-core - update to 4.18.0-193.56.1
kernel - update to 4.18.0-193.56.1
bpftool - update to 4.18.0-193.56.1

• https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.221
• https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.119
• https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.221
• https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.178
• http://seclists.org/oss-sec/2020/q2/86

• Denial of service in Linux kernel
• Red Hat Enterprise Linux for Real Time 8.2 update for kernel-rt
• Red Hat Enterprise Linux 8.2 update for kernel
• Anolis OS update for kernel