CVE-2020-35501 log

Source
Severity Low
Remote No
Type Insufficient validation
Description
A security issue was found in the Linux kernel. The open_by_handle_at syscall is not covered by the current file watch implementation of Auditd. This allows a local attacker with elevated privileges (CAP_DAC_READ_SEARCH capability) to read and modify files without being noticed by the implemented Auditd file watches.

This syscall can still be audited by using the 'syscall auditing feature' by passing open_by_handle_at to it in the rule.  Existing auditing ruleset requirements generally use this mechanism.
Group Package Affected Fixed Severity Status Ticket
AVG-1594 linux 5.15.8.arch1-1 Low Vulnerable
References
https://www.openwall.com/lists/oss-security/2021/02/18/1
https://www.openwall.com/lists/oss-security/2021/02/18/3
https://lore.kernel.org/linux-audit/7230785.EvYhyI6sBW@x2/
https://github.com/linux-audit/audit-kernel/issues/9
Notes
The validity of this CVE is disputed.