UBUNTU-CVE-2020-16120
Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef ("ovl: stack file ops"). This was fixed in kernel version 5.8 by commits 56230d9 ("ovl: verify permissions in ovl_path_open()"), 48bd024 ("ovl: switch to mounter creds in readdir") and 05acefb ("ovl: check permission to open real file"). Additionally, commits 130fdbc ("ovl: pass correct flags for opening real directory") and 292f902 ("ovl: call secutiry hook in ovl_real_ioctl()") in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da ("ovl: do not fail because of O_NOATIMEi") in kernel 5.11.
02 / AFFECTED SOFTWARE
Affected packages
45 explicit affected versions
6 explicit affected versions
26 explicit affected versions
6 explicit affected versions
57 explicit affected versions
191 explicit affected versions
50 explicit affected versions
15 explicit affected versions
31 explicit affected versions
5 explicit affected versions
57 explicit affected versions
121 explicit affected versions
23 explicit affected versions
1 explicit affected versions
1 explicit affected versions
10 explicit affected versions
1 explicit affected versions
7 explicit affected versions
8 explicit affected versions
1 explicit affected versions
15 explicit affected versions
19 explicit affected versions
21 explicit affected versions
15 explicit affected versions
120 explicit affected versions
7 explicit affected versions
10 explicit affected versions
30 explicit affected versions
1 explicit affected versions
29 explicit affected versions
1 explicit affected versions
144 explicit affected versions
1 explicit affected versions
13 explicit affected versions
13 explicit affected versions
13 explicit affected versions
47 explicit affected versions
1 explicit affected versions
17 explicit affected versions
26 explicit affected versions
23 explicit affected versions
10 explicit affected versions
188 explicit affected versions
11 explicit affected versions
15 explicit affected versions
2 explicit affected versions
50 explicit affected versions
165 explicit affected versions
7 explicit affected versions
54 explicit affected versions
1 explicit affected versions
51 explicit affected versions
8 explicit affected versions
63 explicit affected versions
1 explicit affected versions
9 explicit affected versions
5 explicit affected versions
1 explicit affected versions
5 explicit affected versions
1 explicit affected versions
8 explicit affected versions
5 explicit affected versions
32 explicit affected versions
44 explicit affected versions
16 explicit affected versions
26 explicit affected versions
1 explicit affected versions
12 explicit affected versions
38 explicit affected versions
9 explicit affected versions
5 explicit affected versions
76 explicit affected versions
97 explicit affected versions
40 explicit affected versions
5 explicit affected versions
35 explicit affected versions
1 explicit affected versions
12 explicit affected versions
9 explicit affected versions
4 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef ("ovl: stack file ops"). This was fixed in kernel version 5.8 by commits 56230d9 ("ovl: verify permissions in ovl_path_open()"), 48bd024 ("ovl: switch to mounter creds in readdir") and 05acefb ("ovl: check permission to open real file"). Additionally, commits 130fdbc ("ovl: pass correct flags for opening real directory") and 292f902 ("ovl: call secutiry hook in ovl_real_ioctl()") in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da ("ovl: do not fail because of O_NOATIMEi") in kernel 5.11.
05 / REFERENCES