CVE-2020-24394

In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.

• CWE-732

• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.htmlThird Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962254Issue Tracking, Third Party Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.8Release Notes, Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=22cf8419f1319ff87ec759d0ebdff4cbafaee832Patch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20200904-0003/Third Party Advisory
• https://usn.ubuntu.com/4465-1/Third Party Advisory
• https://usn.ubuntu.com/4483-1/Third Party Advisory
• https://usn.ubuntu.com/4485-1/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
• https://www.starwindsoftware.com/security/sw-20210325-0004/Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.htmlThird Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962254Issue Tracking, Third Party Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.8Release Notes, Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=22cf8419f1319ff87ec759d0ebdff4cbafaee832Patch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20200904-0003/Third Party Advisory
• https://usn.ubuntu.com/4465-1/Third Party Advisory
• https://usn.ubuntu.com/4483-1/Third Party Advisory
• https://usn.ubuntu.com/4485-1/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
• https://www.starwindsoftware.com/security/sw-20210325-0004/Third Party Advisory

Published

Aug 19, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24387An issue was discovered in the yh_create_session() function …7.5
• CVE-2020-24388An issue was discovered in the _send_secure_msg() function o…7.5
• CVE-2020-24390eonweb in EyesOfNetwork before 5.3-7 does not properly escap…6.1
• CVE-2020-24391mongo-express before 1.0.0 offers support for certain advanc…9.8
• CVE-2020-24392In voloko twitter-stream 0.1.10, missing TLS hostname valida…5.9
• CVE-2020-24393TweetStream 2.6.1 uses the library eventmachine in an insecu…5.9
• CVE-2020-24395The USB firmware update script of homee Brain Cube v2 (2.28.…6.8
• CVE-2020-24396homee Brain Cube v2 (2.28.2 and 2.28.4) devices have sensiti…7.5
• CVE-2020-24397An issue was discovered in the client side of Zoho ManageEng…7.2
• CVE-2020-24400Magento versions 2.4.0 and 2.3.5 (and earlier) are affected …7.1
• CVE-2020-24401Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affecte…6.5
• CVE-2020-24402Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected…4.9