Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.4
CVE-2020-16120: Linux OverlayFS may let unprivileged users copy protected files
CVE-2020-16120 · published 6 years ago
Summary
The OverlayFS file system in certain Linux kernels does not correctly check permissions when moving files to a user-controlled mount point, allowing a low‑privilege user to copy a file they normally cannot read. This affects Canonical’s Linux, Linux‑Azure, Linux‑AWS, Linux‑LTS‑Xenial and Linux‑AWS‑HWE builds that include the affected kernel version. Upgrade the kernel to version 5.8 or later (or apply the relevant security patches) to restore proper permission checks.
What to do
- Update canonical linux-azure to version 4.15.0-1098.109~14.04.1.
- Update canonical linux-aws-hwe to version 4.15.0-1085.90~16.04.1.
- Update canonical linux-azure to version 4.15.0-1098.109~16.04.1.
- Update canonical linux-gcp to version 4.15.0-1086.98~16.04.1.
- Update canonical linux-hwe to version 4.15.0-120.122~16.04.1.
- Update canonical linux-oracle to version 4.15.0-1056.61~16.04.1.
- Update canonical linux to version 4.15.0-121.123.
- Update canonical linux-aws to version 4.15.0-1086.91.
- Update canonical linux-aws-5.4 to version 5.4.0-1028.29~18.04.1.
- Update canonical linux-azure-4.15 to version 4.15.0-1099.110.
- Update canonical linux-azure-5.4 to version 5.4.0-1031.32~18.04.1.
- Update canonical linux-gcp-4.15 to version 4.15.0-1086.98.
- Update canonical linux-gcp-5.4 to version 5.4.0-1028.29~18.04.1.
- Update canonical linux-gke-4.15 to version 4.15.0-1072.76.
- Update canonical linux-gke-5.0 to version 5.0.0-1049.50.
- Update canonical linux-gke-5.3 to version 5.3.0-1038.40.
- Update canonical linux-gke-5.4 to version 5.4.0-1027.28~18.04.1.
- Update canonical linux-gkeop-5.4 to version 5.4.0-1003.3.
- Update canonical linux-hwe to version 5.3.0-68.63.
- Update canonical linux-hwe-5.4 to version 5.4.0-51.56~18.04.1.
- Update canonical linux-kvm to version 4.15.0-1077.79.
- Update canonical linux-oem to version 4.15.0-1099.109.
- Update canonical linux-oem-osp1 to version 5.0.0-1069.75.
- Update canonical linux-oracle to version 4.15.0-1057.62.
- Update canonical linux-oracle-5.4 to version 5.4.0-1028.29~18.04.1.
- Update canonical linux-raspi-5.4 to version 5.4.0-1021.24~18.04.1.
- Update canonical linux-raspi2 to version 4.15.0-1073.78.
- Update canonical linux-raspi2-5.3 to version 5.3.0-1035.37.
- Update canonical linux-snapdragon to version 4.15.0-1089.98.
- Update canonical linux-aws-fips to version 4.15.0-2030.31.
- Update canonical linux-azure-fips to version 4.15.0-2012.14.
- Update canonical linux-fips to version 4.15.0-1044.50.
- Update canonical linux to version 5.4.0-51.56.
- Update canonical linux-aws to version 5.4.0-1028.29.
- Update canonical linux-azure to version 5.4.0-1031.32.
- Update canonical linux-gcp to version 5.4.0-1028.29.
- Update canonical linux-kvm to version 5.4.0-1026.27.
- Update canonical linux-oem-5.6 to version 5.6.0-1031.32.
- Update canonical linux-oracle to version 5.4.0-1028.29.
- Update canonical linux-raspi to version 5.4.0-1021.24.
- Update canonical linux-riscv to version 5.4.0-36.41.
- Update canonical linux-aws-fips to version 5.4.0-1069.73+fips2.
- Update canonical linux-azure-fips to version 5.4.0-1073.76+fips1.
- Update canonical linux-gcp-fips to version 5.4.0-1067.71~20.04.1.
- Update debian linux to version 5.8.7-1.
- Update canonical linux-azure-fde-5.15 to version 5.15.0-1114.123~20.04.1.
- Update linux linux_kernel to version 5.11 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | linux-azure |
< 4.15.0-1098.109~14.04.1 Fix: upgrade to 4.15.0-1098.109~14.04.1
|
| Ubuntu:Pro:14.04:LTS | canonical | linux | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | linux-aws | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | linux-lts-xenial | All versions |
| Ubuntu:16.04:LTS | canonical | linux-aws-hwe |
< 4.15.0-1085.90~16.04.1 Fix: upgrade to 4.15.0-1085.90~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-azure |
< 4.15.0-1098.109~16.04.1 Fix: upgrade to 4.15.0-1098.109~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-gcp |
< 4.15.0-1086.98~16.04.1 Fix: upgrade to 4.15.0-1086.98~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-hwe |
< 4.15.0-120.122~16.04.1 Fix: upgrade to 4.15.0-120.122~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-oracle |
< 4.15.0-1056.61~16.04.1 Fix: upgrade to 4.15.0-1056.61~16.04.1
|
| Ubuntu:Pro:16.04:LTS | canonical | linux | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-aws | All versions |
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-kvm | All versions |
| Ubuntu:Pro:FIPS:16.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:18.04:LTS | canonical | linux |
< 4.15.0-121.123 Fix: upgrade to 4.15.0-121.123
|
| Ubuntu:18.04:LTS | canonical | linux-aws |
< 4.15.0-1086.91 Fix: upgrade to 4.15.0-1086.91
|
| Ubuntu:18.04:LTS | canonical | linux-aws-5.4 |
< 5.4.0-1028.29~18.04.1 Fix: upgrade to 5.4.0-1028.29~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-azure-4.15 |
< 4.15.0-1099.110 Fix: upgrade to 4.15.0-1099.110
|
| Ubuntu:18.04:LTS | canonical | linux-azure-5.4 |
< 5.4.0-1031.32~18.04.1 Fix: upgrade to 5.4.0-1031.32~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-gcp-4.15 |
< 4.15.0-1086.98 Fix: upgrade to 4.15.0-1086.98
|
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.4 |
< 5.4.0-1028.29~18.04.1 Fix: upgrade to 5.4.0-1028.29~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 |
< 4.15.0-1072.76 Fix: upgrade to 4.15.0-1072.76
|
| Ubuntu:18.04:LTS | canonical | linux-gke-5.0 |
< 5.0.0-1049.50 Fix: upgrade to 5.0.0-1049.50
|
| Ubuntu:18.04:LTS | canonical | linux-gke-5.3 |
< 5.3.0-1038.40 Fix: upgrade to 5.3.0-1038.40
|
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 |
< 5.4.0-1027.28~18.04.1 Fix: upgrade to 5.4.0-1027.28~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 |
< 5.4.0-1003.3 Fix: upgrade to 5.4.0-1003.3
|
| Ubuntu:18.04:LTS | canonical | linux-hwe |
< 5.3.0-68.63 Fix: upgrade to 5.3.0-68.63
|
| Ubuntu:18.04:LTS | canonical | linux-hwe-5.4 |
< 5.4.0-51.56~18.04.1 Fix: upgrade to 5.4.0-51.56~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-kvm |
< 4.15.0-1077.79 Fix: upgrade to 4.15.0-1077.79
|
| Ubuntu:18.04:LTS | canonical | linux-oem |
< 4.15.0-1099.109 Fix: upgrade to 4.15.0-1099.109
|
| Ubuntu:18.04:LTS | canonical | linux-oem-osp1 |
< 5.0.0-1069.75 Fix: upgrade to 5.0.0-1069.75
|
| Ubuntu:18.04:LTS | canonical | linux-oracle |
< 4.15.0-1057.62 Fix: upgrade to 4.15.0-1057.62
|
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.4 |
< 5.4.0-1028.29~18.04.1 Fix: upgrade to 5.4.0-1028.29~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-raspi-5.4 |
< 5.4.0-1021.24~18.04.1 Fix: upgrade to 5.4.0-1021.24~18.04.1
|
| Ubuntu:18.04:LTS | canonical | linux-raspi2 |
< 4.15.0-1073.78 Fix: upgrade to 4.15.0-1073.78
|
| Ubuntu:18.04:LTS | canonical | linux-raspi2-5.3 |
< 5.3.0-1035.37 Fix: upgrade to 5.3.0-1035.37
|
| Ubuntu:18.04:LTS | canonical | linux-snapdragon |
< 4.15.0-1089.98 Fix: upgrade to 4.15.0-1089.98
|
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-aws-fips |
< 4.15.0-2030.31 Fix: upgrade to 4.15.0-2030.31
|
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-azure-fips |
< 4.15.0-2012.14 Fix: upgrade to 4.15.0-2012.14
|
Showing 50 of 85. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-fips |
< 4.15.0-1044.50 Fix: upgrade to 4.15.0-1044.50
|
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:20.04:LTS | canonical | linux |
< 5.4.0-51.56 Fix: upgrade to 5.4.0-51.56
|
| Ubuntu:20.04:LTS | canonical | linux-aws |
< 5.4.0-1028.29 Fix: upgrade to 5.4.0-1028.29
|
| Ubuntu:20.04:LTS | canonical | linux-azure |
< 5.4.0-1031.32 Fix: upgrade to 5.4.0-1031.32
|
| Ubuntu:20.04:LTS | canonical | linux-gcp |
< 5.4.0-1028.29 Fix: upgrade to 5.4.0-1028.29
|
| Ubuntu:20.04:LTS | canonical | linux-kvm |
< 5.4.0-1026.27 Fix: upgrade to 5.4.0-1026.27
|
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 |
< 5.6.0-1031.32 Fix: upgrade to 5.6.0-1031.32
|
| Ubuntu:20.04:LTS | canonical | linux-oracle |
< 5.4.0-1028.29 Fix: upgrade to 5.4.0-1028.29
|
| Ubuntu:20.04:LTS | canonical | linux-raspi |
< 5.4.0-1021.24 Fix: upgrade to 5.4.0-1021.24
|
| Ubuntu:20.04:LTS | canonical | linux-riscv |
< 5.4.0-36.41 Fix: upgrade to 5.4.0-36.41
|
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure-fde-5.15 |
< 5.15.0-1114.123~20.04.1 Fix: upgrade to 5.15.0-1114.123~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-aws-fips |
< 5.4.0-1069.73+fips2 Fix: upgrade to 5.4.0-1069.73+fips2
|
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-azure-fips |
< 5.4.0-1073.76+fips1 Fix: upgrade to 5.4.0-1073.76+fips1
|
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-gcp-fips |
< 5.4.0-1067.71~20.04.1 Fix: upgrade to 5.4.0-1067.71~20.04.1
|
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:26.04 | canonical | linux-nvidia | All versions |
| Debian:12 | debian | linux |
< 5.8.7-1 Fix: upgrade to 5.8.7-1
|
| Debian:13 | debian | linux |
< 5.8.7-1 Fix: upgrade to 5.8.7-1
|
| Debian:14 | debian | linux |
< 5.8.7-1 Fix: upgrade to 5.8.7-1
|
| – | linux | linux_kernel |
< 5.11 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
14.04 16.04 18.04 20.04 cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* |
Original advisory text
Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were ...
Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef ("ovl: stack file ops"). This was fixed in kernel version 5.8 by commits 56230d9 ("ovl: verify permissions in ovl_path_open()"), 48bd024 ("ovl: switch to mounter creds in readdir") and 05acefb ("ovl: check permission to open real file"). Additionally, commits 130fdbc ("ovl: pass correct flags for opening real directory") and 292f902 ("ovl: call secutiry hook in ovl_real_ioctl()") in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da ("ovl: do not fail because of O_NOATIMEi") in kernel 5.11.
References
- https://security-tracker.debian.org/tracker/CVE-2020-16120 Vendor Advisory
- https://ubuntu.com/security/CVE-2020-16120 Third Party Advisory
- https://www.openwall.com/lists/oss-security/2020/10/13/6 Third Party Advisory
- https://ubuntu.com/security/notices/USN-4578-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-4576-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-16120 Third Party Advisory
- https://git.kernel.org/linus/05acefb4872dae89e772729efb194af754c877e8 Patch Third Party Advisory
- https://git.kernel.org/linus/48bd024b8a40d73ad6b086de2615738da0c7004f Patch Third Party Advisory
- https://git.kernel.org/linus/56230d956739b9cb1cbde439d76227d77979a04d Patch Third Party Advisory
- https://git.kernel.org/linus/b6650dab404c701d7fe08a108b746542a934da84 Patch Third Party Advisory
- https://git.kernel.org/linus/d1d04ef8572bc8c22265057bd3d5a79f223f8f52 Patch Third Party Advisory
- https://launchpad.net/bugs/1894980 Issue Tracking Patch Third Party Advisory
- https://launchpad.net/bugs/1900141 Issue Tracking Third Party Advisory
- https://ubuntu.com/USN-4576-1 Third Party Advisory
- https://ubuntu.com/USN-4577-1 Third Party Advisory
- https://ubuntu.com/USN-4578-1 Third Party Advisory
- https://www.openwall.com/lists/oss-security/2020/10/14/2 Mailing List Third Party Advisory
- https://ubuntu.com/security/notices/USN-4577-1 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-266Incorrect Privilege Assignment
Timeline
Published13 Oct 2020
Updated4 Nov 2026
First seen14 May 2026
Track software like this
Free during beta