CVE-2020-12114: 
Linux Kernel vulnerability analysis and mitigation

A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x before 4.14.178, 4.19.x before 4.19.119, and 5.x before 5.3 allows local users to cause a denial of service (panic) by corrupting a mountpoint reference counter. The vulnerability was discovered by Piotr Krysiuk and assigned CVE-2020-12114 in May 2020 (OSS Security).

The vulnerability exists due to a race condition between put_mountpoint() and pivot_root() operations. One thread increments m_count member of struct mountpoint under namespace_sem without holding mount_lock, while another thread simultaneously decrements the same m_count under mount_lock without holding namespace_sem. This allows unprivileged local users to trigger destruction of a mountpoint that is still in use. The CVSS v3.1 base score is 4.7 (Medium) with vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

A successful exploitation of this vulnerability allows local users to cause a denial of service by triggering a kernel panic through corruption of a mountpoint reference counter (OSS Security).

The vulnerability has been reproduced against multiple Linux kernel versions including longterm releases 4.19.118, 4.14.177, 4.9.220, and 4.4.220. A proof of concept was developed that allows unprivileged local users to reliably trigger kernel panic inside VM instances on Google Cloud Platform (OSS Security).

The vulnerability was fixed by grabbing mount_lock before updating m_count in pivot_root(). The fix has been merged into all relevant longterm branches by upstream Linux kernel in versions 4.19.119, 4.14.178, 4.9.221, and 4.4.221. Users should upgrade to these or later versions (OSS Security).

Major Linux distributions including Ubuntu, Debian and SUSE released security updates to address this vulnerability. Ubuntu released updates across multiple versions including 20.04 LTS, 19.10, 18.04 LTS and 16.04 LTS (Ubuntu Security). NetApp also released patches for affected products (NetApp Security).