PT-2021-11781 · Linux+1 · Linux Kernel+1

Lucas Stach · Published 2021-01-25 · Updated 2021-02-02 · CVE-2020-35513

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the fixed version

Description: A flaw in the Linux kernel NFS functionality was found, related to incorrect umask during file or directory modification. This issue affects the way users create and delete objects using NFSv4.2 or newer when multiple processes access the NFS simultaneously, with at least one process not using the new NFSv4.2. A user with access to the NFS could exploit this flaw to starve resources, causing a denial of service.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-271

Related Identifiers

CVE-2020-35513

RHSA-2021:0336

RHSA-2021:0338

RHSA-2021_0336

RHSA-2021_0338

Affected Products

Linux Kernel

Red Hat

References · 13

• https://osv.dev/vulnerability/DEBIAN-CVE-2020-35513 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35513 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35513 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1911309 · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-35513 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-0336.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35513 · Security Note
• https://ubuntu.com/security/CVE-2020-35513 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-35513 · Security Note
• https://t.me/cibsecurity/22592 · Telegram Post
• https://t.me/cvenotify/9273 · Telegram Post
• https://patchwork.kernel.org/project/linux-nfs/patch/20180403203916.GH20297%40fieldses.org · Note
• https://git.kernel.org/linus/880a3a5325489a143269a8e172e7563ebf9897bc · Note