CVE-2020-12826: 
Linux Kernel vulnerability analysis and mitigation

A signal access-control issue was discovered in the Linux kernel before 5.6.5, identified as CVE-2020-12826. The vulnerability exists because exec_id in include/linux/sched.h is only 32 bits, which allows an integer overflow to interfere with the do_notify_parent protection mechanism. This vulnerability was discovered by Adam Zabrocki and reported in March 2020 (Kernel Hardening).

The vulnerability stems from the 32-bit limitation of exec_id in the task_struct structure. When a process executes a new binary, the kernel increments the self_exec_id variable without validation of the current value. Due to this, an attacker can cause an integer overflow of the parent's self_exec_id, allowing a child process to send arbitrary signals to a parent process in a different security domain. The vulnerability has a CVSS v3.1 Base Score of 5.3 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L (NVD).

A local attacker could exploit this vulnerability to send arbitrary signals to a privileged (suidroot) parent process, potentially causing denial of service through arbitrary application crashes. The exploitation is limited by the time required to trigger the integer overflow and the lack of scenarios where signals to a parent process present a substantial operational threat (Red Hat).

The vulnerability requires local access and can take considerable time to exploit. Testing showed it took 7-17 days to achieve the integer overflow depending on the system configuration. The exploit requires creating a mother process, invoking clone() without specific flags, executing the process multiple times to overflow self_exec_id, and then executing a SUID privileged binary (Kernel Hardening).

The vulnerability was fixed in Linux kernel version 5.6.5 by extending exec_id to 64 bits, making it impossible to wrap the exec_id counter. The fix was implemented through commit 7395ea4e65c2 which replaced the 32-bit exec_id with a 64-bit version (GitHub). Various Linux distributions have released patches for their respective kernel versions (Ubuntu Security).