Bug 1911309 (CVE-2020-35513)

Summary:	CVE-2020-35513 kernel: Nfsd failure to clear umask after processing an open or create
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acaringi, adscvr, airlied, alciregi, allarkin, bdettelb, bhu, blc, bmasney, brdeoliv, bskeggs, chwhite, dhoward, dvlasenk, fhrbata, hdegoede, hkrzesin, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, jonathan, josef, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, kmullins, lgoncalv, linville, masami256, mchehab, mlangsdo, nmurray, ptalbert, qzhao, rik.theys, rvrbovsk, security-response-team, steved, tomckay, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 4.17-rc1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system) functionality was found in the way user create and delete object using NFSv4.2 or newer if both simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A user with access to the NFS could use this flaw to starve the resources causing denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-02-02 14:42:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1905208, 1911634, 1911635, 1911636, 1919911
Bug Blocks:	1905197

Description Pedro Sampaio 2020-12-28 17:22:54 UTC

A flaw was found in nfsd. A failure to clear umask after processing an open or create operation results in wrong permissions on a newly-created objects. 

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1903303

Comment 8 Alex 2021-01-10 10:13:23 UTC

Statement:

This flaw is rated as having Low impact because of the exploitation prerequisities and the fact that the attacker could only decrease the permissions of the file or directory.

Comment 13 Alex 2021-01-10 13:18:58 UTC

Acknowledgments:

Name: J. Bruce Fields (fieldses.org)

Comment 14 Alex 2021-01-10 13:19:00 UTC

External References:

https://patchwork.kernel.org/project/linux-nfs/patch/20180403203916.GH20297@fieldses.org/

Comment 15 Petr Matousek 2021-01-25 11:50:36 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1919911]

Comment 16 Justin M. Forbes 2021-01-25 17:36:27 UTC

This was fixed for Fedora with the 4.15.18 stable kernel updates.

Comment 17 errata-xmlrpc 2021-02-02 12:00:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0336 https://access.redhat.com/errata/RHSA-2021:0336

Comment 18 errata-xmlrpc 2021-02-02 12:02:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0338 https://access.redhat.com/errata/RHSA-2021:0338

Comment 19 Product Security DevOps Team 2021-02-02 14:42:12 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-35513