An issue was discovered in the Linux kernel before 5.9.3. iouring takes a non-refcounted reference to the filesstruct of the process that submitted a request, causing execve() to incorrectly optimize unshare_fd(), aka CID-0f2122045b94.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-29534.json"
[
{
"digest": {
"function_hash": "254686120697543111568027384287403842009",
"length": 265.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_uring_flush"
},
"signature_type": "Function",
"id": "CVE-2020-29534-0769266b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "19074685669744543627909717474377070083",
"length": 1181.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_init_req"
},
"signature_type": "Function",
"id": "CVE-2020-29534-132ff61e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "299205860047909739589125968351709282806",
"length": 1381.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_submit_sqes"
},
"signature_type": "Function",
"id": "CVE-2020-29534-2bba930a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "42852162473042673150067491057175852951",
"length": 272.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "__io_free_req_finish"
},
"signature_type": "Function",
"id": "CVE-2020-29534-2e97029d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "259967424077192665742539945198707538085",
"length": 110.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_wq_files_match"
},
"signature_type": "Function",
"id": "CVE-2020-29534-32d40be7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "160112764353134954343228651522215123315",
"length": 163.0
},
"signature_version": "v1",
"target": {
"file": "fs/file.c",
"function": "exit_files"
},
"signature_type": "Function",
"id": "CVE-2020-29534-34d232bd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "128379710968391151810951468990188600626",
"length": 210.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_req_free_batch_finish"
},
"signature_type": "Function",
"id": "CVE-2020-29534-40b8b918",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"277530332583752460884806276034569512378",
"202743303760288313002245921698928144574",
"201779616248916462763036198206472045878",
"332336742127765418255497328298524466204",
"288846847955491198986111026699673701199",
"289020229373232967254227220260850644437",
"142714113807671526822314758866859000386"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "include/linux/sched.h"
},
"signature_type": "Line",
"id": "CVE-2020-29534-48983d4a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "103641736845900578674066374181522244208",
"length": 998.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_sq_offload_start"
},
"signature_type": "Function",
"id": "CVE-2020-29534-50d12720",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "335048337228620637464826387781076206440",
"length": 1806.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_sq_thread"
},
"signature_type": "Function",
"id": "CVE-2020-29534-521715b8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "141208006700749919553370830369710960277",
"length": 10548.0
},
"signature_version": "v1",
"target": {
"file": "kernel/fork.c",
"function": "copy_process"
},
"signature_type": "Function",
"id": "CVE-2020-29534-58089a6e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "122931616031326829417744680509216335318",
"length": 1325.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "SYSCALL_DEFINE6"
},
"signature_type": "Function",
"id": "CVE-2020-29534-5f4c2d14",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "253925033129066508817079374796392756410",
"length": 342.0
},
"signature_version": "v1",
"target": {
"file": "kernel/fork.c",
"function": "__put_task_struct"
},
"signature_type": "Function",
"id": "CVE-2020-29534-651f4ac0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "209024008402031664896118397829319821003",
"length": 850.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "__io_cqring_fill_event"
},
"signature_type": "Function",
"id": "CVE-2020-29534-728dbbe9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"104111516008199167337955963342755212353",
"103089472457187725370553385807275412415",
"84342268045418610003259467132018112930",
"43226193672083722944451277231551230547",
"215035933889141092703817561140644487517",
"275635472905991426205391636648470363722",
"332885205516671174879523664638085337360",
"330805810862175005623103934659048956164",
"67893506409900822955637429467394357448",
"307450282213497928403531594115591891308",
"280472722637919695832070442703430021162",
"205104886428340688569359811117872004804",
"176712267824659464373794686903367137172",
"245565059132663930915850147070027369104",
"108631100633953495030342185985259570416",
"280292086232650178179754229622120196466",
"245090243983527160055362873960537411285",
"152540541343383353625421958090169240171",
"153812466047336337420402094236770475495",
"50906908144239750930374115290940719440",
"278631102956030607566267870101097634731",
"110020996400224697825187841736967242811",
"116800689948861910469391483384894006740",
"114699063118130149068629409224897334255",
"26873536372886479519532270834993960243",
"178758476308197838558828786938001379125",
"206753549152625799298391588391355852241",
"191778072278071803686302667368619730531",
"204921199526067387153273746535509698617",
"148781892219409193444302920614088337148",
"276940440687379119352915509494921256126",
"170843374936365601691124369431602425070",
"211901462206091804211309412167936711729",
"169985013205432638391180213449809148390",
"224694985959713089047202270503057350913",
"254471016733053207615040580431492340579",
"217367041506145398465115656459468725015",
"242751851752992885659723048815226430478",
"205902120811505221397845899443605779193",
"176290129592358937601913760787968060550",
"38851681454584186756074387960890685531",
"282440251145335965931136356694188815345",
"236146187117834130409597676700439108706",
"217705457146717858029169287751353281093",
"306692445549368323640090877487270668946",
"272031294989626580281424654122783634502",
"70708294054026310307102396164552398012",
"284415232304087163619790999009213104781",
"117245580669260957979399270132080793746",
"61162903497239680626627133292534022877",
"182688041765434196825292289184718910645",
"120052307577332567165342778807421225537",
"254251674405350873794933263137683890326",
"13385788615104885337143708350134041652",
"70835380901024982553587689568557753233",
"200879430685823128210972887628404440469",
"262854345211352604844609120281115261944",
"240606847426469164104238706410170102982",
"10126763163732712211227938772098906198",
"207673092233209824856490524638765230679",
"281445805157027598023079928905509872934",
"114178410830245860967618134806724055409",
"110595205583739953222613736935005183132",
"304920789666184062886984290732092756056",
"36514595494819967990606707913100316407",
"277685954890116005587044944378414289492",
"6213412367246637243358453193332175957",
"323972063724491732087640377187250090696",
"66592696984675790265824830172196424243",
"154711429514737090761376035113818349672",
"209987175017303329359000682061130041204",
"38371776943031637590608247824864348759",
"308277007544564099058501530952820676621",
"169022835048781578187070145494554058102",
"143447340532481695662528454979989683276",
"62297421615387600356336647127430150763",
"168958729659686397039629498956532167832",
"116597105388540483060729620872349538434",
"142333256373467541435297385959017849812",
"163380619827607402095713816315390392854",
"77665790192018486207787040145451572441",
"86010745015008058914177423346472214336",
"258942548096264430322294768277132824010",
"36519988287692438717702181516469756397",
"45817510527807767310741747937723659492",
"164995567618823889598878022707004610332",
"188924663640577888510273530261518330367",
"123049715531202780832556566957305744449",
"200509006395076008701514145325449612801",
"73620534493488259171670525963934747541",
"235681669048385955690305065172737865613",
"323697787814476534378761932717706032185",
"73198719798743447866091200181828662883",
"126704320592431542662894484899639601718",
"149341720188957790727130529874293753109",
"93515231661556432252511752936842621767",
"276093387614207030427676126398170133075",
"232654431724418226804808091190458392079",
"281574211729764930408038565195041547906",
"336597576346387787946594199832421831538",
"338930364828748965992345896565689641557",
"181199463144606495029748632780171590029",
"100649221136060846295943433134594637507",
"302115504440649373474053049275790904580",
"265321037723676868885954948823438061837",
"237496219869037390224876149296034258536",
"241963817711703091127439262530614673836",
"82677314461917908248688432999315733690",
"193567426716716923541250752162839684759",
"184516336851624695869461466453319013196",
"80056343490457842495093735385228254626",
"304439469835962054919130375358583592133",
"291828966944245388744469982705636521397"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c"
},
"signature_type": "Line",
"id": "CVE-2020-29534-9671b69f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"32783665681606095996855233227296750152",
"34175153418038827059898456118174253021",
"8290139063968075778006643087087853315",
"119905937970977439059255276355508525864",
"246055586220925154045726388819325649530",
"205663063959453208381776757943268627027",
"219483689949039564992562126070178797782"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "fs/exec.c"
},
"signature_type": "Line",
"id": "CVE-2020-29534-9f0b600f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "31155178993341283821440315159728059242",
"length": 1065.0
},
"signature_version": "v1",
"target": {
"file": "fs/exec.c",
"function": "bprm_execve"
},
"signature_type": "Function",
"id": "CVE-2020-29534-adf43fe1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "279108872147898317978930007572048166334",
"length": 667.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_uring_get_fd"
},
"signature_type": "Function",
"id": "CVE-2020-29534-c8ea8320",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "270950110352101268206376619142114816782",
"length": 829.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_uring_cancel_files"
},
"signature_type": "Function",
"id": "CVE-2020-29534-cc54e724",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"158506313202960575301705202479550972113",
"314980892774887276092337402311550211154",
"179323208266444187436096952264174010870",
"61690821261353663902824693595115670288",
"336320883302438763954631957169443150406",
"31782637115999687594700314940033507632",
"187039856955880466267973747180076385106",
"75463317806189824152872188469877409086",
"162811679881821992331253025856379878788",
"70308362674754413688303391980931452211"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "kernel/fork.c"
},
"signature_type": "Line",
"id": "CVE-2020-29534-d07e1b69",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"217552067940475882721403601550635970056",
"280698441402701701241784014388714704762",
"279036776695909997775515311065133857482",
"23585221180606734774860814129072928135",
"174342674210402214704303421025814292632",
"321992557609337606728760630797723239788",
"113015416138484796072134064880576581205",
"101508107108631268589747763204394828617"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "fs/file.c"
},
"signature_type": "Line",
"id": "CVE-2020-29534-d7407fe8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "173872940726257339371949946709498190310",
"length": 574.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_grab_files"
},
"signature_type": "Function",
"id": "CVE-2020-29534-d9c1081c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "50995361742435486488529214816720994125",
"length": 368.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_req_drop_files"
},
"signature_type": "Function",
"id": "CVE-2020-29534-dfe83066",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"line_hashes": [
"190460497596728211462839569607856109368",
"84938938989510713727604094029479591584",
"174377008750555076500706284222757812425",
"268204822673263655875987421805738437697"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "init/init_task.c"
},
"signature_type": "Line",
"id": "CVE-2020-29534-e013415b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "228729997480940363127061028984793733221",
"length": 572.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_req_free_batch"
},
"signature_type": "Function",
"id": "CVE-2020-29534-e8f5639a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
},
{
"digest": {
"function_hash": "134366962124568874517713876861330119325",
"length": 664.0
},
"signature_version": "v1",
"target": {
"file": "fs/io_uring.c",
"function": "io_close_prep"
},
"signature_type": "Function",
"id": "CVE-2020-29534-fd886158",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@0f2122045b946241a9e549c2a76cea54fa58a7ff",
"deprecated": false
}
]