PT-2020-15827

Name of the Vulnerable Software and Affected Versions OpenZFS versions prior to 2.0.0-rc1 Description The issue allows execute permissions for all directories when OpenZFS is used on FreeBSD. Recommendations For versions prior to 2.0.0-rc1, update to version 2.0.0-rc1 or later to resolve the issu...

PT-2020-15828

Name of the Vulnerable Software and Affected Versions OpenZFS versions prior to 2.0.0-rc1 Description The issue misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777, leading to a disruption in access control. This occurs due to a critical...

CVE-2020-24716: Incorrect Authorization

OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories...

CVE-2020-24717: Incorrect Default Permissions

OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777...

FreeBSD : sysutils/openzfs-kmod -- critical permissions issues (2ed7e8db-e234-11ea-9392-002590bc43be)

Andrew Walker reports : Issue 1 : Users are always granted permissions to cd into a directory. The check for whether execute is present on directories is a de-facto no-op. This cannot be mitigated without upgrading. Even setting an explicit 'deny - execute' NFSv4 ACE will be bypassed. Issue 2 : A...