CVE-2020-24717: 
Homebrew vulnerability analysis and mitigation

OpenZFS before version 2.0.0-rc1, when used on FreeBSD, contains a security vulnerability where group permissions are misinterpreted as user permissions. This issue was discovered in August 2020 and affects the permission handling mechanism, specifically demonstrated by mode 0770 being treated as equivalent to mode 0777 (NVD, CVE).

The vulnerability stems from incorrect UNIX permissions checking in the FreeBSD implementation of OpenZFS. The issue specifically affects how the system interprets group permissions, treating them as user permissions. This results in a privilege escalation where files with mode 0770 (rwxrwx---) are effectively treated as mode 0777 (rwxrwxrwx), granting execute permissions to all users regardless of intended restrictions. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability can lead to privilege escalation as files intended to be restricted become accessible to unauthorized users. This particularly affects system security when group-only executable files become executable by all users, potentially exposing sensitive system resources or functionality to unauthorized access (NVD).

The vulnerability requires local access to the system and can be exploited by setting specific file permissions. The exploit can be demonstrated by creating a file with mode 0770, which should restrict access to owner and group members, but instead becomes accessible to all users as if it had mode 0777 permissions (NVD).

The vulnerability was fixed in OpenZFS version 2.0.0-rc1. The fix involves correcting the UNIX permissions checking mechanism in the FreeBSD implementation. Users are advised to upgrade to OpenZFS version 2.0.0-rc1 or later to address this security issue (GitHub Patch).