CVE-2020-29374

An issue was discovered in the Linux kernel related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended read access.

This issue was rated as having Moderate impact because of the prerequisities required for successful exploitation.

This is an issue with zygote Android model where the child process shares anon pages with the parent, despite the child can attack the parent and at the same time child and parent run with different levels of privileges.

This is not a model applicable to Red Hat Enterprise Linux applications that we are aware of.

To mitigate this issue when this model is required it is recommended to use execve() after fork, followed by dropping or changing privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.