OpenZFS Misinterprets Group Permissions on FreeBSD
CVE-2020-24717

7.8HIGH

Key Information:

Vendor: Openzfs
Status: Openzfs
Vendor: CVE Published:; 27 August 2020

What is CVE-2020-24717?

OpenZFS, utilized on FreeBSD systems prior to version 2.0.0-rc1, incorrectly interprets group permissions as equivalent to user permissions. This vulnerability can lead to unintended access control levels, resulting in unauthorized activities. For instance, a directory set with permissions mode 0770 may operate similarly to mode 0777, thereby exposing sensitive data to potential threats. Immediate attention and updates are advised to mitigate associated risks.