CVE-2020-24394

Опубликовано: 19 авг. 2020

Источник: nvd

CVSS3: 7.1

CVSS2: 3.6

EPSS Низкий

Описание

In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html
Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962254
Issue Tracking
Third Party Advisory
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.8
Release Notes
Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=22cf8419f1319ff87ec759d0ebdff4cbafaee832
Patch
Vendor Advisory
https://security.netapp.com/advisory/ntap-20200904-0003/
Third Party Advisory
https://usn.ubuntu.com/4465-1/
Third Party Advisory
https://usn.ubuntu.com/4483-1/
Third Party Advisory
https://usn.ubuntu.com/4485-1/
Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
Patch
Third Party Advisory
https://www.starwindsoftware.com/security/sw-20210325-0004/
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html
Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962254
Issue Tracking
Third Party Advisory
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.8
Release Notes
Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=22cf8419f1319ff87ec759d0ebdff4cbafaee832
Patch
Vendor Advisory
https://security.netapp.com/advisory/ntap-20200904-0003/
Third Party Advisory
https://usn.ubuntu.com/4465-1/
Third Party Advisory
https://usn.ubuntu.com/4483-1/
Third Party Advisory
https://usn.ubuntu.com/4485-1/
Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
Patch
Third Party Advisory
https://www.starwindsoftware.com/security/sw-20210325-0004/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия до 5.7.8 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Конфигурация 3

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:a:oracle:sd-wan_edge:8.2:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12533:*:*:*:vsphere:*:*

cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12658:*:*:*:vsphere:*:*

cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12859:*:*:*:vsphere:*:*

cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13170:*:*:*:vsphere:*:*

cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13586:*:*:*:vsphere:*:*

cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13861:*:*:*:vsphere:*:*

EPSS

Процентиль: 2%

0.00016

Низкий

7.1 High

CVSS3

3.6 Low

CVSS2

Дефекты

CWE-732

Связанные уязвимости

CVE-2020-24394

CVSS3: 7.1

ubuntu

почти 5 лет назад

CVE-2020-24394

CVSS3: 7.1

redhat

около 5 лет назад

CVE-2020-24394

CVSS3: 7.1

msrc

больше 4 лет назад

Описание отсутствует

CVE-2020-24394

CVSS3: 7.1

debian

почти 5 лет назад

In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) ca ...

GHSA-fvv9-qhmx-c8wm

CVSS3: 7.1

github

около 3 лет назад

EPSS

Процентиль: 2%

0.00016

Низкий

7.1 High

CVSS3

3.6 Low

CVSS2

Дефекты

CWE-732