{"id":"ASB-A-174738029","details":"In __split_huge_pmd of huge_memory.c, there is a possible incorrectly mapped page due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-174738029","CVE-2020-29368"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2022-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-03-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/c444eb564fb16645c172d550359cb3d75fe8a040"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2022-03-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/c444eb564fb16645c172d550359cb3d75fe8a040"],"severity":"High","spl":"2022-03-05","types":["EoP"],"vanir_signatures":[{"digest":{"length":706,"function_hash":"62518233568053495378856513386487914666"},"id":"ASB-A-174738029-91a22839","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/c444eb564fb16645c172d550359cb3d75fe8a040","target":{"file":"mm/huge_memory.c","function":"__split_huge_pmd"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/c444eb564fb16645c172d550359cb3d75fe8a040","target":{"file":"mm/huge_memory.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["186575377702378297788877657258455811578","62280791117301714953475261891481182799","157717077011240822145473274654014649277","254348974979409281079232387991930179706","297789660306839784457895863694677159988","184260271923848413843788031012598222837","160587493053965929408564373791498951336","303745111411998574222958840361365078339","312463488833165955664499971355803067084","238308424915957855665396696743588872857","41344355247723848313475928304551289332","113369615935754813213873612931572692496","24352837519995616835921924564141996617","339096172300213892236954473131030810260","108625528906053915165477637024389099595"]},"id":"ASB-A-174738029-dac3e6fa","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-174738029.json"}}],"schema_version":"1.9.0"}