CVE-2020-16120
Overlayfs Permission Bypass Vulnerability
Description
Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef ("ovl: stack file ops"). This was fixed in kernel version 5.8 by commits 56230d9 ("ovl: verify permissions in ovl_path_open()"), 48bd024 ("ovl: switch to mounter creds in readdir") and 05acefb ("ovl: check permission to open real file"). Additionally, commits 130fdbc ("ovl: pass correct flags for opening real directory") and 292f902 ("ovl: call secutiry hook in ovl_real_ioctl()") in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da ("ovl: do not fail because of O_NOATIMEi") in kernel 5.11.
INFO
Published Date :
Feb. 10, 2021, 8:15 p.m.
Last Modified :
Nov. 18, 2021, 6:40 p.m.
Source :
[email protected]
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.4
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2020-16120.
| URL | Resource |
|---|---|
| https://git.kernel.org/linus/05acefb4872dae89e772729efb194af754c877e8 | Patch Third Party Advisory |
| https://git.kernel.org/linus/48bd024b8a40d73ad6b086de2615738da0c7004f | Patch Third Party Advisory |
| https://git.kernel.org/linus/56230d956739b9cb1cbde439d76227d77979a04d | Patch Third Party Advisory |
| https://git.kernel.org/linus/b6650dab404c701d7fe08a108b746542a934da84 | Patch Third Party Advisory |
| https://git.kernel.org/linus/d1d04ef8572bc8c22265057bd3d5a79f223f8f52 | Patch Third Party Advisory |
| https://launchpad.net/bugs/1894980 | Issue Tracking Patch Third Party Advisory |
| https://launchpad.net/bugs/1900141 | Issue Tracking Third Party Advisory |
| https://ubuntu.com/USN-4576-1 | Third Party Advisory |
| https://ubuntu.com/USN-4577-1 | Third Party Advisory |
| https://ubuntu.com/USN-4578-1 | Third Party Advisory |
| https://www.openwall.com/lists/oss-security/2020/10/14/2 | Mailing List Third Party Advisory |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2020-16120 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2020-16120 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by [email protected]
May. 14, 2024
Action Type Old Value New Value -
Reanalysis by [email protected]
Nov. 18, 2021
Action Type Old Value New Value Removed CWE NIST CWE-269 Added CWE NIST NVD-CWE-Other -
Initial Analysis by [email protected]
Feb. 18, 2021
Action Type Old Value New Value Added CVSS V2 NIST (AV:L/AC:L/Au:N/C:P/I:N/A:N) Added CVSS V3.1 NIST AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Changed Reference Type https://git.kernel.org/linus/05acefb4872dae89e772729efb194af754c877e8 No Types Assigned https://git.kernel.org/linus/05acefb4872dae89e772729efb194af754c877e8 Patch, Third Party Advisory Changed Reference Type https://git.kernel.org/linus/48bd024b8a40d73ad6b086de2615738da0c7004f No Types Assigned https://git.kernel.org/linus/48bd024b8a40d73ad6b086de2615738da0c7004f Patch, Third Party Advisory Changed Reference Type https://git.kernel.org/linus/56230d956739b9cb1cbde439d76227d77979a04d No Types Assigned https://git.kernel.org/linus/56230d956739b9cb1cbde439d76227d77979a04d Patch, Third Party Advisory Changed Reference Type https://git.kernel.org/linus/b6650dab404c701d7fe08a108b746542a934da84 No Types Assigned https://git.kernel.org/linus/b6650dab404c701d7fe08a108b746542a934da84 Patch, Third Party Advisory Changed Reference Type https://git.kernel.org/linus/d1d04ef8572bc8c22265057bd3d5a79f223f8f52 No Types Assigned https://git.kernel.org/linus/d1d04ef8572bc8c22265057bd3d5a79f223f8f52 Patch, Third Party Advisory Changed Reference Type https://launchpad.net/bugs/1894980 No Types Assigned https://launchpad.net/bugs/1894980 Issue Tracking, Patch, Third Party Advisory Changed Reference Type https://launchpad.net/bugs/1900141 No Types Assigned https://launchpad.net/bugs/1900141 Issue Tracking, Third Party Advisory Changed Reference Type https://ubuntu.com/USN-4576-1 No Types Assigned https://ubuntu.com/USN-4576-1 Third Party Advisory Changed Reference Type https://ubuntu.com/USN-4577-1 No Types Assigned https://ubuntu.com/USN-4577-1 Third Party Advisory Changed Reference Type https://ubuntu.com/USN-4578-1 No Types Assigned https://ubuntu.com/USN-4578-1 Third Party Advisory Changed Reference Type https://www.openwall.com/lists/oss-security/2020/10/14/2 No Types Assigned https://www.openwall.com/lists/oss-security/2020/10/14/2 Mailing List, Third Party Advisory Added CWE NIST CWE-269 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 5.11 Added CPE Configuration OR *cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2020-16120 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2020-16120
weaknesses.
Exploit Prediction
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.
0.05 }} 0.00%
score
0.14284
percentile