Vulnetix
Try Vulnetix Request Demo
CVE-2020-16120 PUBLISHED

Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef ("ovl: stack file ops"). This was fixed in kernel version 5.8 by commits 56230d9 ("ovl: verify permissions in ovl_path_open()"), 48bd024 ("ovl: switch to mounter creds in readdir") and 05acefb ("ovl: check permission to open real file"). Additionally, commits 130fdbc ("ovl: pass correct flags for opening real directory") and 292f902 ("ovl: call secutiry hook in ovl_real_ioctl()") in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da ("ovl: do not fail because of O_NOATIMEi") in kernel 5.11.

EPSS 0.05% · 14.4th percentile

Risk Scores

EPSS Score
0.05%
14.4th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:FIPS:16.04:LTSlinux-fips4.4.0-1072.78, 4.4.0-1069.75, 4.4.0-1081.88
Ubuntu:18.04:LTSlinux-aws-5.00, 5.0.0-1021.24~18.04.1, 5.0.0-1022.25~18.04.1
Ubuntu:20.04:LTSlinux-aws5.4.0-1011.11, 5.4.0-1025.25, 5.4.0-1024.24
Ubuntu:Pro:FIPS:20.04:LTSlinux-azure-fips0, 5.4.0-1022.22+fips1
Ubuntu:18.04:LTSlinux-gcp-5.35.3.0-1012.13~18.04.1, 5.3.0-1010.11~18.04.1, 5.3.0-1009.10~18.04.1
Ubuntu:18.04:LTSlinux-gcp-5.45.4.0-1025.25~18.04.1, 5.4.0-1024.24~18.04.1, 0
Ubuntu:18.04:LTSlinux-raspi2-5.35.3.0-1017.19~18.04.1, 5.3.0-1028.30~18.04.2, 5.3.0-1027.29~18.04.1
Ubuntu:18.04:LTSlinux-gke-5.35.3.0-1014.15~18.04.1, 5.3.0-1016.17~18.04.1, 5.3.0-1017.18~18.04.1
Ubuntu:Pro:16.04:LTSlinux4.4.0-10.25, 4.4.0-9.24, 4.4.0-8.23
Ubuntu:20.04:LTSlinux-riscv0, 5.4.0-24.28, 5.4.0-26.30
Ubuntu:Pro:16.04:LTSlinux-aws4.4.0-1190.205, 4.4.0-1159.174, 4.4.0-1158.173
Ubuntu:Pro:16.04:LTSlinux-kvm4.4.0-1088.97, 4.4.0-1132.142, 4.4.0-1131.141
Ubuntu:Pro:FIPS-updates:18.04:LTSlinux-azure-fips0, 4.15.0-1002.2, 4.15.0-2006.7
Ubuntu:18.04:LTSlinux-gcp-edge4.18.0-1009.10~18.04.1, 4.18.0-1011.12~18.04.1, 4.18.0-1012.13~18.04.1
Ubuntu:22.04:LTSlinux-riscv5.15.0-1016.18, 0, 5.13.0-1004.4
Ubuntu:16.04:LTSlinux-hwe4.15.0-30.32~16.04.1, 4.15.0-24.26~16.04.1, 4.15.0-96.97~16.04.1
Ubuntu:22.04:LTSlinux-intel-iot-realtime5.15.0-1073.75, 0
Ubuntu:Pro:FIPS-updates:20.04:LTSlinux-gcp-fips5.4.0-1021.21+fips1, 0
Ubuntu:Pro:14.04:LTSlinux-azure4.15.0-1082.92~14.04.1, 0, 4.15.0-1023.24~14.04.1
Ubuntu:20.04:LTSlinux-azure5.4.0-1006.6, 5.4.0-1025.25, 0

…and 59 more

Timeline

References

Open in Interactive Console →