CVE-2020-11884: 
Linux Kernel vulnerability analysis and mitigation

CVE-2020-11884 affects Linux kernel versions 4.19 through 5.6.7 on the s390 platform. The vulnerability was discovered by Al Viro and disclosed in April 2020. It involves a race condition in the enable_sacf_uaccess function in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade (Ubuntu Security, Debian Security).

The vulnerability stems from a race condition in the s390 platform's memory management code where page table upgrades in kernel sections using secondary address mode can interfere with kernel instructions. When a thread is in secondary space mode with control register 1 pointing to kernel page table, a concurrent page table upgrade from another thread can cause the instruction fetching to occur through an incorrect page table mapping (Kernel Git). The vulnerability has a CVSS v3.1 base score of 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (Ubuntu Security).

A successful exploitation of this vulnerability could allow a local attacker to cause a denial of service (system crash) or execute arbitrary code with elevated privileges on affected s390x systems (Ubuntu Security, Debian Security).

The vulnerability requires local access and can be exploited by a local attacker. The attack complexity is considered high due to the specific timing requirements needed to trigger the race condition (Ubuntu Security).

The vulnerability was fixed in Linux kernel version 5.6.8. Multiple Linux distributions have released patches including Ubuntu (versions 20.04, 19.10, 18.04, 16.04), Debian (version 4.19.98-1+deb10u1), and Fedora (versions 30, 31, 32). The fix involves protecting against concurrent page table upgrades by disabling interrupts in enable_sacf_uaccess and only updating control registers currently in use for user processes (Kernel Git).