CVE-2020-29369: 
Linux Kernel vulnerability analysis and mitigation

A race condition vulnerability (CVE-2020-29369) was discovered in mm/mmap.c in the Linux kernel before version 5.7.11. The vulnerability involves a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, identified as CID-246c320a8cfe (CVE MITRE, NVD).

The vulnerability occurs when a VMA (Virtual Memory Area) with VM_GROWSDOWN or VM_GROWSUP flag set can change its size under mmap_read_lock(). This leads to a race condition with __do_munmap() where one thread can modify the VMA while another thread is attempting to unmap the region. The issue specifically involves the expand_downwards and expand_upwards functions conflicting with page-table free operations. The vulnerability has a CVSS v3.1 Base Score of 7.0 (HIGH) with vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The vulnerability could allow a local attacker with user privileges to crash the system or potentially expose sensitive information (NetApp Advisory).

The vulnerability requires local access with low privileges. It has high attack complexity, requires no user interaction, and has a limited scope. The vulnerability was discovered by Jann Horn and has been publicly disclosed (Kernel Commit).

The vulnerability was fixed in Linux kernel version 5.7.11. The fix involves avoiding downgrading mmap_lock in __do_munmap() if detached VMAs are next to VM_GROWSDOWN or VM_GROWSUP VMA. Users should upgrade to Linux kernel version 5.7.11 or later to address this vulnerability (Kernel Changelog).

The vulnerability was initially assigned CVE-2021-20200 by Red Hat but was later identified as a duplicate of CVE-2020-29369. This led to some confusion in the security community, as evidenced by discussions on the oss-security mailing list (OSS Security).