Security restrictions bypass in Linux kernel - CVE-2020-16120

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU99771

Security restrictions bypass in Linux kernel - CVE-2020-16120

Published: February 10, 2021 / Updated: May 12, 2025


Vulnerability identifier: #VU99771
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-16120
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local privileged user to gain access to sensitive information.

The vulnerability exists due to security restrictions bypass error within the ovl_open_realfile() and ovl_change_flags() functions in fs/overlayfs/file.c. A local privileged user can gain access to sensitive information.


Affected software

Linux kernel
Ubuntu
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-generic-lpae-hwe-16.04 (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-4.15.0-120-lowlatency (Ubuntu package)
linux-image-4.15.0-120-generic (Ubuntu package)
linux-image-4.15.0-120-generic-lpae (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-4.15.0-121-generic-lpae (Ubuntu package)
linux-image-4.15.0-121-generic (Ubuntu package)
linux-image-4.15.0-121-lowlatency (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-4.15.0-1056-oracle (Ubuntu package)
linux-image-4.15.0-1057-oracle (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1072-gke (Ubuntu package)
linux-image-gke-4.15 (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.15.0-1073-raspi2 (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.15.0-1077-kvm (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-4.15.0-1085-aws (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1086-aws (Ubuntu package)
linux-image-4.15.0-1086-gcp (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.15.0-1089-snapdragon (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-4.15.0-1098-azure (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1099-oem (Ubuntu package)
linux-image-4.15.0-1099-azure (Ubuntu package)
linux-image-gke-5.0 (Ubuntu package)
linux-image-5.0.0-1049-gke (Ubuntu package)
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.0.0-1069-oem-osp1 (Ubuntu package)
linux-image-5.3.0-68-generic (Ubuntu package)
linux-image-5.3.0-68-lowlatency (Ubuntu package)
linux-image-gkeop-5.3 (Ubuntu package)
linux-image-raspi2-hwe-18.04 (Ubuntu package)
linux-image-5.3.0-1035-raspi2 (Ubuntu package)
linux-image-gke-5.3 (Ubuntu package)
linux-image-5.3.0-1038-gke (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-5.4.0-51-lowlatency (Ubuntu package)
linux-image-5.4.0-51-generic-lpae (Ubuntu package)
linux-image-5.4.0-51-generic (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1021-raspi (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.4.0-1026-kvm (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-5.4.0-1028-gcp (Ubuntu package)
linux-image-5.4.0-1028-aws (Ubuntu package)
linux-image-5.4.0-1028-oracle (Ubuntu package)
linux-image-5.4.0-1031-azure (Ubuntu package)

How to mitigate CVE-2020-16120

Install update from vendor's repository.

Linux kernel - update to 5.8
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to 4.15.0.120.121
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to 4.15.0.120.121
linux-image-generic-lpae-hwe-16.04 (Ubuntu package) - update to 4.15.0.120.121
linux-image-generic-hwe-16.04 (Ubuntu package) - update to 4.15.0.120.121
linux-image-oem (Ubuntu package) - addressed in versions 4.15.0.120.121, 4.15.0.1099.103, 5.4.0.51.54
linux-image-4.15.0-120-lowlatency (Ubuntu package) - update to 4.15.0-120.122~16.04.1
linux-image-4.15.0-120-generic (Ubuntu package) - update to 4.15.0-120.122~16.04.1
linux-image-4.15.0-120-generic-lpae (Ubuntu package) - update to 4.15.0-120.122~16.04.1
linux-image-generic (Ubuntu package) - addressed in versions 4.15.0.121.108, 5.4.0.51.54
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.15.0.121.108, 5.4.0.51.54
linux-image-virtual (Ubuntu package) - addressed in versions 4.15.0.121.108, 5.4.0.51.54
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.15.0.121.108, 5.4.0.51.54
linux-image-4.15.0-121-generic-lpae (Ubuntu package) - update to 4.15.0-121.123
linux-image-4.15.0-121-generic (Ubuntu package) - update to 4.15.0-121.123
linux-image-4.15.0-121-lowlatency (Ubuntu package) - update to 4.15.0-121.123
linux-image-oracle (Ubuntu package) - addressed in versions 4.15.0.1056.46, 5.4.0.1028.12, 5.4.0.1028.25
linux-image-4.15.0-1056-oracle (Ubuntu package) - update to 4.15.0-1056.61~16.04.1
linux-image-4.15.0-1057-oracle (Ubuntu package) - update to 4.15.0-1057.62
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1057.67
linux-image-4.15.0-1072-gke (Ubuntu package) - update to 4.15.0-1072.76
linux-image-gke-4.15 (Ubuntu package) - update to 4.15.0.1072.76
linux-image-gke (Ubuntu package) - addressed in versions 4.15.0.1072.76, 4.15.0.1086.87, 5.4.0.1028.36
linux-image-raspi2 (Ubuntu package) - addressed in versions 4.15.0.1073.70, 5.4.0.1021.56
linux-image-4.15.0-1073-raspi2 (Ubuntu package) - update to 4.15.0-1073.78
linux-image-kvm (Ubuntu package) - addressed in versions 4.15.0.1077.73, 5.4.0.1026.24
linux-image-4.15.0-1077-kvm (Ubuntu package) - update to 4.15.0-1077.79
linux-image-aws-hwe (Ubuntu package) - update to 4.15.0.1085.81
linux-image-4.15.0-1085-aws (Ubuntu package) - update to 4.15.0-1085.90~16.04.1
linux-image-gcp (Ubuntu package) - addressed in versions 4.15.0.1086.87, 5.4.0.1028.16, 5.4.0.1028.36
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1086.88
linux-image-4.15.0-1086-aws (Ubuntu package) - update to 4.15.0-1086.91
linux-image-4.15.0-1086-gcp (Ubuntu package) - addressed in versions 4.15.0-1086.98, 4.15.0-1086.98~16.04.1
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1086.104
linux-image-snapdragon (Ubuntu package) - update to 4.15.0.1089.92
linux-image-4.15.0-1089-snapdragon (Ubuntu package) - update to 4.15.0-1089.98
linux-image-azure (Ubuntu package) - addressed in versions 4.15.0.1098.74, 4.15.0.1098.92, 5.4.0.1031.13, 5.4.0.1031.29
linux-image-4.15.0-1098-azure (Ubuntu package) - addressed in versions 4.15.0-1098.109~14.04.1, 4.15.0-1098.109~16.04.1
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1099.72
linux-image-4.15.0-1099-oem (Ubuntu package) - update to 4.15.0-1099.109
linux-image-4.15.0-1099-azure (Ubuntu package) - update to 4.15.0-1099.110
linux-image-gke-5.0 (Ubuntu package) - update to 5.0.0.1049.33
linux-image-5.0.0-1049-gke (Ubuntu package) - update to 5.0.0-1049.50
linux-image-oem-osp1 (Ubuntu package) - addressed in versions 5.0.0.1069.67, 5.4.0.51.54
linux-image-5.0.0-1069-oem-osp1 (Ubuntu package) - update to 5.0.0-1069.75
linux-image-5.3.0-68-generic (Ubuntu package) - update to 5.3.0-68.63
linux-image-5.3.0-68-lowlatency (Ubuntu package) - update to 5.3.0-68.63
linux-image-gkeop-5.3 (Ubuntu package) - update to 5.3.0.68.125
linux-image-raspi2-hwe-18.04 (Ubuntu package) - update to 5.3.0.1035.24
linux-image-5.3.0-1035-raspi2 (Ubuntu package) - update to 5.3.0-1035.37
linux-image-gke-5.3 (Ubuntu package) - update to 5.3.0.1038.21
linux-image-5.3.0-1038-gke (Ubuntu package) - update to 5.3.0-1038.40
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.4.0.51.54
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.4.0.51.54
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.4.0.51.54
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.4.0.51.54
linux-image-5.4.0-51-lowlatency (Ubuntu package) - update to 5.4.0-51.56~18.04.1
linux-image-5.4.0-51-generic-lpae (Ubuntu package) - update to 5.4.0-51.56~18.04.1
linux-image-5.4.0-51-generic (Ubuntu package) - update to 5.4.0-51.56~18.04.1
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.51.56~18.04.45
linux-image-5.4.0-1021-raspi (Ubuntu package) - update to 5.4.0-1021.24~18.04.1
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1021.25
linux-image-raspi (Ubuntu package) - update to 5.4.0.1021.56
linux-image-5.4.0-1026-kvm (Ubuntu package) - update to 5.4.0-1026.27
linux-image-aws (Ubuntu package) - addressed in versions 5.4.0.1028.13, 5.4.0.1028.29
linux-image-5.4.0-1028-gcp (Ubuntu package) - update to 5.4.0-1028.29~18.04.1
linux-image-5.4.0-1028-aws (Ubuntu package) - update to 5.4.0-1028.29~18.04.1
linux-image-5.4.0-1028-oracle (Ubuntu package) - update to 5.4.0-1028.29~18.04.1
linux-image-5.4.0-1031-azure (Ubuntu package) - update to 5.4.0-1031.32~18.04.1

External References

Related Security Bulletins