CVE-2020-12652: 
Linux Kernel vulnerability analysis and mitigation

The __mptctl_ioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to hold an incorrect lock during the ioctl operation and trigger a race condition, i.e., a "double fetch" vulnerability, aka CID-28d76df18f0a. The vulnerability was discovered by Tom Hatskevich and assigned CVE-2020-12652 (Kernel Git).

The vulnerability occurs when the ioctl handler fetches a parameter from user memory twice, creating a race condition which could result in incorrect locking of internal data structures. Specifically, the code takes a lock based on one lookup of "iocp", but then user memory changes and looks up "iocp" again with a different value, resulting in holding the incorrect lock (Debian LTS).

A local user permitted to access /dev/mptctl could use this vulnerability to cause a denial of service (crash or memory corruption) or achieve privilege escalation. However, the security impact is somewhat limited since these operations are all privileged and root already has significant system access (Kernel Git).

The vulnerability requires local access and high privileges to exploit. It has a CVSS v3.1 Base Score of 6.4 (Medium) with vector: AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H (NetApp Advisory).

The vulnerability was fixed in Linux kernel version 5.4.14 by modifying the code to pass the "iocp" pointer to the functions to avoid the second lookup. This fix removed approximately 100 lines of code from the driver (Kernel Git).