CVSS 3.1
7.1 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NCVE-2020-24394
High (7.1). EPSS 0.4% chance of exploitation in the next 30 days.
In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
- CWE
- CWE-732
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- linux:linux_kernel
- opensuse:leap
- oracle:sd-wan_edge
- starwindsoftware:starwind_virtual_san
References
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962254
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.8
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=22cf8419f1319ff87ec759d0ebdff4cbafaee832
- https://security.netapp.com/advisory/ntap-20200904-0003/