CVE-2020-16120

Advisory lineage Upstream: 0 Downstream: 20
Modified
Published: 10 Feb 2021, 19:45
Last modified:16 Sept 2024, 18:49

Vulnerability Summary

Overall Risk (default)
low
20/100
CVSS Score
5.1 MEDIUM
v3.1 (cve.org)
EPSS Score
0.06% LOW
0% probability +0.02%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

10 Feb 2021, 19:45
Published
Vulnerability first disclosed
16 Sept 2024, 18:49
Last Modified
Vulnerability information updated

Description

Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef ("ovl: stack file ops"). This was fixed in kernel version 5.8 by commits 56230d9 ("ovl: verify permissions in ovl_path_open()"), 48bd024 ("ovl: switch to mounter creds in readdir") and 05acefb ("ovl: check permission to open real file"). Additionally, commits 130fdbc ("ovl: pass correct flags for opening real directory") and 292f902 ("ovl: call secutiry hook in ovl_real_ioctl()") in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da ("ovl: do not fail because of O_NOATIMEi") in kernel 5.11.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.1CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
  • v3.1•MEDIUM•Score: 4.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
  • v2.0•LOW•Score: 2.1AV:L/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.06%• Percentile: 20%

Techniques & Countermeasures

  • CWE-266•Incorrect Privilege Assignment

    A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Affected Systems

  • canonical•ubuntu_linux

    14.04 | 16.04 | 18.04 | 20.04

  • linux kernel•linux kernel

    ≥ 5.11-stable, < 5.11.0

  • linux•linux_kernel

    < 5.11

References (11)