7.1

CVE-2020-24394

In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version < 5.7.8
Canonical ≫ Ubuntu Linux Version14.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version16.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version20.04 SwEditionlts
Opensuse ≫ Leap Version15.1
Oracle ≫ Sd-wan Edge Version8.2
Starwindsoftware ≫ Starwind Virtual San Versionv8 Updatebuild12533 SwPlatformvsphere
Starwindsoftware ≫ Starwind Virtual San Versionv8 Updatebuild12658 SwPlatformvsphere
Starwindsoftware ≫ Starwind Virtual San Versionv8 Updatebuild12859 SwPlatformvsphere
Starwindsoftware ≫ Starwind Virtual San Versionv8 Updatebuild13170 SwPlatformvsphere
Starwindsoftware ≫ Starwind Virtual San Versionv8 Updatebuild13586 SwPlatformvsphere
Starwindsoftware ≫ Starwind Virtual San Versionv8 Updatebuild13861 SwPlatformvsphere
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.36% 0.277
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvd@nist.gov 3.6 3.9 4.9
AV:L/AC:L/Au:N/C:P/I:P/A:N
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

https://www.oracle.com/security-alerts/cpuApr2021.html
Patch
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html
Third Party Advisory
https://usn.ubuntu.com/4485-1/
Third Party Advisory
https://usn.ubuntu.com/4465-1/
Third Party Advisory
https://usn.ubuntu.com/4483-1/
Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962254
Third Party Advisory
Issue Tracking
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.8
Vendor Advisory
Release Notes
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=22cf8419f1319ff87ec759d0ebdff4cbafaee832
Patch
Vendor Advisory
https://security.netapp.com/advisory/ntap-20200904-0003/
Third Party Advisory
https://www.starwindsoftware.com/security/sw-20210325-0004/
Third Party Advisory