CVE-2020-35513 Denial of service in kernel
A Linux kernel NFS flaw allows users to cause resource starvation and denial of service via incorrect umask handling during concurrent NFSv4.2 access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35513?
CVE-2020-35513 is a medium-severity denial of service vulnerability in Linux kernel, published on 25 Jan 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system) functionality was found in the way user create and delete object using NFSv4.2 or newer if both simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A user with access to the NFS could use this flaw to starve the resources causing denial of service.
Weakness: CWE-271
Which versions are affected by CVE-2020-35513?
It affects 2 products.
Products include Linux kernel, Redhat Enterprise Linux.
How do I fix CVE-2020-35513?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-35513 being exploited?
There is no known exploitation of CVE-2020-35513 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2020-35513, GHSA-7qpq-c35p-wc3c, UBUNTU-CVE-2020-35513.