CVE-2020-16120
Summary
| CVE | CVE-2020-16120 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-02-10 20:15:00 UTC |
| Updated | 2021-11-18 18:40:00 UTC |
| Description | Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef ("ovl: stack file ops"). This was fixed in kernel version 5.8 by commits 56230d9 ("ovl: verify permissions in ovl_path_open()"), 48bd024 ("ovl: switch to mounter creds in readdir") and 05acefb ("ovl: check permission to open real file"). Additionally, commits 130fdbc ("ovl: pass correct flags for opening real directory") and 292f902 ("ovl: call secutiry hook in ovl_real_ioctl()") in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da ("ovl: do not fail because of O_NOATIMEi") in kernel 5.11. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 20.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 20.04 | All | All | All |
| Operating System | Linux | Linux Kernel | All | All | All | All |
| Operating System | Linux | Linux Kernel | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| kernel/git/torvalds/linux.git - Linux kernel source tree | CONFIRM | git.kernel.org | Patch, Third Party Advisory |
| USN-4578-1: Linux kernel vulnerabilities | Ubuntu security notices | Ubuntu | UBUNTU | ubuntu.com | Third Party Advisory |
| kernel/git/torvalds/linux.git - Linux kernel source tree | CONFIRM | git.kernel.org | Patch, Third Party Advisory |
| kernel/git/torvalds/linux.git - Linux kernel source tree | CONFIRM | git.kernel.org | Patch, Third Party Advisory |
| Bug #1894980 “CVE-2020-16120: unprivileged overlayfs permission ...” : Bugs : linux package : Ubuntu | UBUNTU | launchpad.net | Issue Tracking, Patch, Third Party Advisory |
| USN-4576-1: Linux kernel vulnerabilities | Ubuntu security notices | Ubuntu | UBUNTU | ubuntu.com | Third Party Advisory |
| kernel/git/torvalds/linux.git - Linux kernel source tree | CONFIRM | git.kernel.org | Patch, Third Party Advisory |
| USN-4577-1: Linux kernel vulnerabilities | Ubuntu security notices | Ubuntu | UBUNTU | ubuntu.com | Third Party Advisory |
| kernel/git/torvalds/linux.git - Linux kernel source tree | CONFIRM | git.kernel.org | Patch, Third Party Advisory |
| Bug #1900141 “overlay: permission regression in 5.4.0-51.56 due ...” : Bugs : linux package : Ubuntu | UBUNTU | launchpad.net | Issue Tracking, Third Party Advisory |
| oss-security - Re: CVE-2020-16120 - incorrect unprivileged overlayfs permission checking | CONFIRM | www.openwall.com | Mailing List, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Giuseppe Scrivano
Legacy QID Mappings
- 670375 EulerOS Security Update for kernel (EulerOS-SA-2021-1950)
- 670396 EulerOS Security Update for kernel (EulerOS-SA-2021-1929)
- 670936 EulerOS Security Update for kernel (EulerOS-SA-2021-1929)
- 750376 OpenSUSE Security Update for RT kernel (openSUSE-SU-2021:0242-1)
- 750533 OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2020:2112-1)
- 750609 OpenSUSE Security Update for the Linux Kernel (openSUSE-SU-2020:1906-1)
- 750738 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2020:3326-1)
- 900100 CBL-Mariner Linux Security Update for kernel 5.10.52.1
- 900305 CBL-Mariner Linux Security Update for kernel 5.10.57.1
- 900320 CBL-Mariner Linux Security Update for kernel 5.10.60.1
- 901249 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (6522-1)
- 903418 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (3885)
- 905831 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (3885-1)