Bugzilla – Bug 1181362
VUL-1: CVE-2020-35513: kernel: nfsd failure to clear umask after processing an open or create
Last modified: 2021-01-25 17:52:15 UTC
rh#1911309 A flaw was found in nfsd. A failure to clear umask after processing an open or create operation results in wrong permissions on a newly-created objects. References: https://patchwork.kernel.org/project/linux-nfs/patch/20180403203916.GH20297@fieldses.org/ https://bugzilla.redhat.com/show_bug.cgi?id=1911309 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-35513
Do I understand correctly that the problem was fixed by the upstream commit 880a3a5325489a143269a8e172e7563ebf9897bc nfsd: fix incorrect umasks in March 2018 (in 4.17 kernel)? The umask was introduced in 4.10 kernel and not backported to SLE 4.4 kernels, so our old branches are unaffected, and cve/linux-4.12 already contains the fix (backported via git-fixes).
(In reply to Takashi Iwai from comment #1) > Do I understand correctly that the problem was fixed by the upstream commit > 880a3a5325489a143269a8e172e7563ebf9897bc > nfsd: fix incorrect umasks > in March 2018 (in 4.17 kernel)? > > The umask was introduced in 4.10 kernel and not backported to SLE 4.4 > kernels, so our old branches are unaffected, and cve/linux-4.12 already > contains the fix (backported via git-fixes). That's how I read it as well. Thanks for the analysis.