CVE-2020-16120: 
Linux Kernel vulnerability analysis and mitigation

CVE-2020-16120 is a security vulnerability in the Linux kernel's overlayfs implementation that was discovered in 2020. The vulnerability allowed improper permission checking when copying up files in an overlayfs, which could be exploited from within a user namespace if unprivileged user namespaces were allowed. This issue was introduced in kernel version 4.19 by commit d1d04ef and was fixed in kernel version 5.8 through multiple patches (Kernel Patch, Ubuntu Security).

The vulnerability stems from overlayfs not properly performing permission checks when copying up files from a lower layer to an upper layer. When overlayfs copies up a file, it was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, such as a removable device. The issue has a CVSS v3.1 Base Score of 4.4 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (NVD).

An unprivileged local attacker could exploit this vulnerability to bypass intended restrictions and gain read access to restricted files that they would not normally have permission to access. This was particularly impactful on systems where unprivileged user namespaces were enabled by default, such as Ubuntu (Ubuntu Security, OSS Security).

The vulnerability could be exploited from within a user namespace when unprivileged user namespaces were allowed. The exploit involved mounting a FUSE filesystem, then mounting shiftfs on top of it, and finally creating an overlay mount that uses a directory with invalid IDs as the lower filesystem (Launchpad Bug).

The vulnerability was fixed in kernel version 5.8 through multiple patches including commits 56230d9, 48bd024, and 05acefb. For systems where unprivileged user namespaces are enabled but not needed, a temporary mitigation is to disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 via sysctl. This can be made permanent by adding the setting to /etc/sysctl.d/99-userns.conf (Ubuntu Security).

The vulnerability primarily affected Ubuntu systems where unprivileged user namespaces were enabled by default. Other distributions were less impacted as they typically did not enable unprivileged overlayfs by default. The fix caused a regression in overlay mounts within user namespaces which was later addressed in kernel 5.11 (Launchpad Bug).