CVE-2020-36322: 
Linux Kernel vulnerability analysis and mitigation

CVE-2020-36322 was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6. The vulnerability was identified in the fuse_do_getattr() function which calls make_bad_inode() in inappropriate situations, causing a system crash. The issue was discovered and disclosed in early 2021, affecting Linux kernel's FUSE (Filesystem in Userspace) implementation (Debian Security, Ubuntu Security).

The vulnerability occurs when fuse_do_getattr() finds that attributes returned by the FUSE server are inconsistent and calls make_bad_inode(), which modifies the inode mode to S_IFREG. This modification confuses dnotify, preventing proper teardown of its structures and eventually leading to a system crash. The vulnerability has a CVSS 3.x score of 5.5 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (StarWind Security).

When exploited, this vulnerability can cause a system crash through improper handling of bad inodes. A local user permitted to run a FUSE server could trigger this vulnerability to cause a denial of service. The issue is particularly concerning as it affects the fundamental filesystem operations (Debian Security).

The vulnerability can be exploited by a local user who has permissions to run a FUSE server. The exploitation involves triggering the fuse_do_getattr() function with inconsistent attributes, leading to system instability. The attack requires local access and high privileges to execute (StarWind Security).

The issue was fixed in Linux kernel version 5.10.6 through commit 5d069dbe8aaf2a197142558b6fb2978189ba3454. The fix involves avoiding the call to make_bad_inode() on a live inode and switching to a private flag on the fuse inode. Various Linux distributions have backported the fix to their supported kernel versions. For example, Debian fixed this in version 4.19.232-1 for the oldstable distribution (buster) (Debian Security).