7.5

CVE-2020-25584

In FreeBSD 13.0-STABLE before n245118, 12.2-STABLE before r369552, 11.4-STABLE before r369560, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE before p9, a superuser inside a FreeBSD jail configured with the non-default allow.mount permission could cause a race condition between the lookup of ".." and remounting a filesystem, allowing access to filesystem hierarchy outside of the jail.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Freebsd ≫ Freebsd Version < 11.4
Freebsd ≫ Freebsd Version >= 12.0 < 12.2
Freebsd ≫ Freebsd Version 11.4 Update -
Freebsd ≫ Freebsd Version 11.4 Update beta1
Freebsd ≫ Freebsd Version 11.4 Update p1
Freebsd ≫ Freebsd Version 11.4 Update p2
Freebsd ≫ Freebsd Version 11.4 Update p3
Freebsd ≫ Freebsd Version 11.4 Update p4
Freebsd ≫ Freebsd Version 11.4 Update p5
Freebsd ≫ Freebsd Version 11.4 Update rc1
Freebsd ≫ Freebsd Version 11.4 Update rc2
Freebsd ≫ Freebsd Version 12.2 Update -
Freebsd ≫ Freebsd Version 12.2 Update p1
Freebsd ≫ Freebsd Version 12.2 Update p2
Freebsd ≫ Freebsd Version 13.0 Update beta1
Freebsd ≫ Freebsd Version 13.0 Update beta2
Freebsd ≫ Freebsd Version 13.0 Update beta3
Freebsd ≫ Freebsd Version 13.0 Update beta4
Freebsd ≫ Freebsd Version 13.0 Update rc1
Freebsd ≫ Freebsd Version 13.0 Update rc2
Freebsd ≫ Freebsd Version 13.0 Update rc3
Freebsd ≫ Freebsd Version 13.0 Update rc4
Freebsd ≫ Freebsd Version 13.0 Update rc5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.077
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 0.8 6
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
NIST 6.2 1.9 10
AV:L/AC:H/Au:N/C:C/I:C/A:C
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

https://security.FreeBSD.org/advisories/FreeBSD-SA-21:10.jail_mount.asc
Vendor Advisory
https://security.netapp.com/advisory/ntap-20210423-0009/
Third Party Advisory