CVE-2020-29371: 
Linux Kernel vulnerability analysis and mitigation

CVE-2020-29371 is a security vulnerability discovered in the Linux kernel's romfs filesystem implementation, specifically in the romfs_dev_read function within fs/romfs/storage.c. The vulnerability affects Linux kernel versions before 5.8.4. The issue involves uninitialized memory being leaked to userspace due to improper handling of read operations at filesystem size boundaries (NVD, Ubuntu).

The vulnerability stems from the romfs_dev_read() function's behavior when handling read operations near the filesystem size limit. When the function detects that a requested operation would cross the filesystem size limit, it silently truncates the requested number of bytes instead of returning an error. This leads to a scenario where, if a file's content starts one byte before the filesystem size limit, the readpage() operation would only fill a single byte of the supplied page while leaving the rest uninitialized, resulting in uninitialized kernel memory being exposed to userspace. The vulnerability has been assigned a CVSS v3.1 Base Score of 3.3 (LOW) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows local users to potentially access uninitialized kernel memory through the romfs filesystem, leading to information disclosure. The impact is limited as it requires local access and only affects systems using the romfs filesystem (Ubuntu).

The vulnerability requires local access to the system and the ability to interact with a romfs filesystem. An attacker would need to create specific conditions where file reads occur near the filesystem size boundary to trigger the uninitialized memory leak (Project Zero).

The vulnerability was fixed in Linux kernel version 5.8.4 by modifying the romfs_dev_read() function to return an error code instead of truncating the read when the requested read operation would go beyond the end of the filesystem. The fix was implemented through commit bcf85fcedfdd17911982a3e3564fcfec7b01eebd (Kernel Commit).