PT-2021-11161 · Freebsd · Freebsd

Published 2021-04-06 · Updated 2021-06-03 · CVE-2020-25584

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 13.0-STABLE before n245118 FreeBSD versions 12.2-STABLE before r369552 FreeBSD versions 11.4-STABLE before r369560 FreeBSD versions 13.0-RC5 before p1 FreeBSD versions 12.2-RELEASE before p6 FreeBSD versions 11.4-RELEASE before p9

Description: A superuser inside a FreeBSD jail configured with the non-default allow.mount permission could cause a race condition between the lookup of ".." and remounting a filesystem, allowing access to filesystem hierarchy outside of the jail.

Recommendations: For FreeBSD versions 13.0-STABLE before n245118, update to a version after n245118. For FreeBSD versions 12.2-STABLE before r369552, update to a version after r369552. For FreeBSD versions 11.4-STABLE before r369560, update to a version after r369560. For FreeBSD versions 13.0-RC5 before p1, update to a version after p1. For FreeBSD versions 12.2-RELEASE before p6, update to a version after p6. For FreeBSD versions 11.4-RELEASE before p9, update to a version after p9.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2020-25584

FREEBSD-SA-21_10

Affected Products

Freebsd

References · 7

• https://security.freebsd.org/advisories/FreeBSD-SA-21:10.jail_mount.asc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25584 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25584 · Security Note
• https://freebsd.org/security/advisories/FreeBSD-SA-21:10.jail_mount.asc · Note
• https://security.netapp.com/advisory/ntap-20210423-0009 · Note
• https://t.me/cvenotify/13347 · Telegram Post
• https://t.me/cvenotify/13579 · Telegram Post