CVE-2020-24394: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered. The vulnerability was discovered in August 2020 and affects Linux kernel versions prior to 5.7.8 (NVD, Debian).

The vulnerability exists in the NFS server implementation where it fails to properly honor umask settings when setting permissions while creating filesystem objects if the underlying filesystem does not support ACLs. The issue has a CVSS v3.1 Base Score of 7.1 HIGH with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (NVD).

A successful exploitation of this vulnerability could allow an attacker to expose sensitive information or violate system integrity by creating files with incorrect permissions. This is particularly concerning when the underlying filesystem lacks ACL support, as the umask settings are not properly applied (Ubuntu).

The vulnerability requires local access and low privileges to exploit. It specifically affects NFSv4.2 implementations and can be triggered when both the client and server are running affected kernel versions. The issue is reproducible on filesystems mounted with noacl option or those lacking ACL support (Debian).

The vulnerability was fixed in Linux kernel version 5.7.8 with commit 22cf8419f131. The fix ensures proper application of umask on filesystems without ACL support. For systems that cannot immediately update, a workaround is to use NFSv4.1 instead of NFSv4.2, though this is not a long-term solution (Kernel).