CVE-2020-35513
First published: Mon Dec 21 2020(Updated: )
A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system) functionality was found in the way user create and delete object using NFSv4.2 or newer if both simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A user with access to the NFS could use this flaw to starve the resources causing denial of service.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:3.10.0-1160.15.2.rt56.1152.el7 | 0:3.10.0-1160.15.2.rt56.1152.el7 |
| redhat/kernel | <0:3.10.0-1160.15.2.el7 | 0:3.10.0-1160.15.2.el7 |
| Linux Linux kernel | =4.2 | |
| Redhat Enterprise Linux | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-35513 https://nvd.nist.gov/vuln/detail/CVE-2020-35513 https://patchwork.kernel.org/project/linux-nfs/patch/20180403203916.GH20297@fieldses.org/
- https://bugzilla.redhat.com/show_bug.cgi?id=1911309
- https://access.redhat.com/errata/RHSA-2021:0338
- https://access.redhat.com/errata/RHSA-2021:0336
- https://access.redhat.com/security/cve/cve-2020-35513
- https://patchwork.kernel.org/project/linux-nfs/patch/20180403203916.GH20297@fieldses.org/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1903303
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1919911
- https://patchwork.kernel.org/project/linux-nfs/patch/20180403203916.GH20297%40fieldses.org/
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-35513.
What is the severity of CVE-2020-35513?
The severity of CVE-2020-35513 is medium.
How does CVE-2020-35513 affect Linux kernel NFS?
CVE-2020-35513 affects Linux kernel NFS by allowing a user to create and delete objects using NFSv4.2 or newer with an incorrect umask during file or directory modification.
Which versions of the Linux kernel are affected by CVE-2020-35513?
Versions up to and including 4.17 of the Linux kernel are affected by CVE-2020-35513.
Are there any remedies available for CVE-2020-35513?
Remedies are available for CVE-2020-35513, such as upgrading to kernel version 4.17 or higher.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/softwarecombine
- agent/severity
- agent/weakness
- agent/author
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-35513
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/event
- agent/tags
- agent/trending
- package-manager/redhat
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/4.2
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/7.0