CVE-2020-29368: 
Linux Kernel vulnerability analysis and mitigation

A race condition vulnerability (CVE-2020-29368) was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before version 5.7.5. The copy-on-write implementation could grant unintended write access due to a race condition in a THP (Transparent Huge Pages) mapcount check, also known as CID-c444eb564fb1 (NVD).

The vulnerability exists in the THP (Transparent Huge Pages) implementation where write protect anon page faults require an accurate mapcount to decide whether to break the COW (Copy-On-Write) or not. If the COW triggers while other processes sharing the page are under a huge pmd split, the mapcount calculation could be inaccurate due to lack of proper synchronization during the transfer from head page to tail pages (Kernel Commit). The vulnerability has a CVSS v3.1 Base Score of 7.0 (HIGH) with vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The vulnerability affects the memory management subsystem and could potentially allow local attackers to gain unintended write access to read-only memory pages (NetApp Advisory).

The vulnerability requires local access and high attack complexity. It has been publicly discussed and documented, though no public exploits are known. The vulnerability was discovered and reported by Jann Horn (Kernel Commit).

The vulnerability was fixed in Linux kernel version 5.7.5 by adding proper serialization using page locks around __split_huge_pmd_locked. The fix ensures accurate mapcount calculation by preventing race conditions during the transfer of counts from head page to tail pages (Kernel Commit).