CVE-2020-25284

A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel. Incorrect capability checks could alllow a local user with root priviledges (but no capabilities) to add or remove Rados Block Devices from the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

As the rbd module can be loaded by a priviledged user or process, its use can be disabled by preventing the module from loading with the following instructions:

echo "install rbd /bin/true" >> /etc/modprobe.d/disable-rdb.conf

The system will need to be restarted if the modules isloaded. In most circumstances, the rbd kernel modules will be unable to be unloaded while in use.

If the system requires this module to work correctly, (Such as a CEPH node) this mitigation may not be suitable.

If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.