https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 02:58:36 +0000 https://cve.radiocsirt.org/vuln/cve-2020-16120 <p><strong>Affected:</strong> Linux kernel</p> <p>Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef (&#34;ovl: stack file ops&#34;). This was fixed in kernel version 5.8 by commits 56230d9 (&#34;ovl: verify permissions in ovl_path_open()&#34;), 48bd024 (&#34;ovl: switch to mounter creds in readdir&#34;) and 05acefb (&#34;ovl: check permission to open real file&#34;). Additionally, commits 130fdbc (&#34;ovl: pass correct flags for opening real directory&#34;) and 292f902 (&#34;ovl: call secutiry hook in ovl_real_ioctl()&#34;) in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da (&#34;ovl: do not fail because of O_NOATIMEi&#34;) in kernel 5.11.</p> <p><strong>Affected:</strong> Linux kernel</p> <p>Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef (&#34;ovl: stack file ops&#34;). This was fixed in kernel version 5.8 by commits 56230d9 (&#34;ovl: verify permissions in ovl_path_open()&#34;), 48bd024 (&#34;ovl: switch to mounter creds in readdir&#34;) and 05acefb (&#34;ovl: check permission to open real file&#34;). Additionally, commits 130fdbc (&#34;ovl: pass correct flags for opening real directory&#34;) and 292f902 (&#34;ovl: call secutiry hook in ovl_real_ioctl()&#34;) in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da (&#34;ovl: do not fail because of O_NOATIMEi&#34;) in kernel 5.11.</p> https://cve.radiocsirt.org/vuln/cve-2020-16120