What is CVE-2020-25584?

CVE-2020-25584 is a high-severity vulnerability in Freebsd, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 7.5/10. Published 2021-04-07.

How severe is CVE-2020-25584?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Freebsd

CVE-2020-25584

In FreeBSD 13.0-STABLE before n245118, 12.2-STABLE before r369552, 11.4-STABLE before r369560, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE before p9, a superuser inside a FreeBSD jail configured with the non-default allow.mount permission could cause a race condition between the lookup of ".." and remounting a filesystem, allowing access to filesystem hierarchy outside of the jail.

Vulnerability class: Race Condition

EPSS: 0.002 (7.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Freebsd — versions 11.4, 12.2, 13.0
N/a Freebsd — versions FreeBSD 12.2-RELEASE before p6, 11.4-RELEASE before p9

Weakness classification (CWE)

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

References

secteam@freebsd.org (x_refsource_MISC, Vendor Advisory)
secteam@freebsd.org (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2020-25584?: CVE-2020-25584 is a high-severity vulnerability in Freebsd, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 7.5/10. Published 2021-04-07.
How severe is CVE-2020-25584?: High severity. CVSS v3 base score is 7.5 out of 10.