低危 linux linux_kernel 特权管理不恰当

CVE编号

CVE-2020-16120

利用情况

暂无

补丁情况

官方补丁

披露时间

2021-02-11
漏洞描述
Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef ("ovl: stack file ops"). This was fixed in kernel version 5.8 by commits 56230d9 ("ovl: verify permissions in ovl_path_open()"), 48bd024 ("ovl: switch to mounter creds in readdir") and 05acefb ("ovl: check permission to open real file"). Additionally, commits 130fdbc ("ovl: pass correct flags for opening real directory") and 292f902 ("ovl: call secutiry hook in ovl_real_ioctl()") in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da ("ovl: do not fail because of O_NOATIMEi") in kernel 5.11.
解决建议
建议您更新当前系统或软件至最新版,完成漏洞的修复。
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
系统 canonical ubuntu_linux 14.04 -
运行在以下环境
系统 canonical ubuntu_linux 16.04 -
运行在以下环境
系统 canonical ubuntu_linux 18.04 -
运行在以下环境
系统 canonical ubuntu_linux 20.04 -
运行在以下环境
系统 debian_10 linux * Up to
(excluding)
4.19.208-1
运行在以下环境
系统 debian_9 linux * Up to
(excluding)
4.9.240-2
运行在以下环境
系统 linux linux_kernel * Up to
(excluding)
5.11
运行在以下环境
系统 opensuse_Leap_15.2 linux * Up to
(excluding)
5.3.18-lp152.3.5.1
运行在以下环境
系统 oracle linux_7 linux * Up to
(excluding)
4.14.35-2047.501.0.el7
运行在以下环境
系统 oracle linux_8 linux * Up to
(excluding)
5.4.17-2036.104.4.el8
运行在以下环境
系统 oracle_7 linux * Up to
(excluding)
4.14.35-2047.501.0.el7
运行在以下环境
系统 oracle_8 linux * Up to
(excluding)
5.4.17-2036.104.4.el8
运行在以下环境
系统 sles_12_SP5 linux * Up to
(excluding)
4.12.14-16.34.1
运行在以下环境
系统 suse_12_SP5 linux * Up to
(excluding)
4.12.14-16.34.1
运行在以下环境
系统 ubuntu_14.04 linux * Up to
(excluding)
4.15.0-1098.109~14.04.1
运行在以下环境
系统 ubuntu_14.04_lts linux-azure * Up to
(excluding)
4.15.0-1098.109~14.04.1
运行在以下环境
系统 ubuntu_16.04 linux * Up to
(excluding)
4.15.0-1085.90~16.04.1
运行在以下环境
系统 ubuntu_16.04_lts linux-aws-hwe * Up to
(excluding)
4.15.0-1085.90~16.04.1
运行在以下环境
系统 ubuntu_18.04 linux * Up to
(excluding)
5.4.0-1021.24~18.04.1
运行在以下环境
系统 ubuntu_18.04_lts linux * Up to
(excluding)
4.15.0-121.123
运行在以下环境
系统 ubuntu_20.04 linux * Up to
(excluding)
5.4.0-1021.24
阿里云评分
1.7
  • 攻击路径
    本地
  • 攻击复杂度
    复杂
  • 权限要求
    管控权限
  • 影响范围
    有限影响
  • EXP成熟度
    未验证
  • 补丁情况
    官方补丁
  • 数据保密性
    无影响
  • 数据完整性
    无影响
  • 服务器危害
    无影响
  • 全网数量
    100
CWE-ID 漏洞类型
CWE-269 特权管理不恰当
NVD-CWE-Other
阿里云安全产品覆盖情况