CVE-2020-14367 Path traversal in Chrony
An attacker with privileged access can exploit a symlink vulnerability in chrony's PID file creation to overwrite arbitrary files, causing data loss and denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-14367?
CVE-2020-14367 is a medium-severity path traversal vulnerability in Canonical Ubuntu Linux, published on 24 Aug 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while still running as the root user, and when it's opened for writing, chronyd does not check for an existing symbolic link with the same file name. This flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing to any destination file in the system, resulting in data loss and a denial of service due to the path traversal.
Weakness: CWE-59
Which versions are affected by CVE-2020-14367?
It affects 3 products.
Linux distribution packages (24)
chrony SUSE:HPE Helion OpenStack 8 | All versions | 4.1-5.9.1 |
augeas SUSE:Linux Enterprise Installer Updates 15 SP3 | All versions | 1.10.1-3.9.1 |
augeas SUSE:Linux Enterprise Micro 5.0 | All versions | 1.10.1-3.9.1 |
augeas SUSE:Linux Enterprise Micro 5.1 | All versions | 1.10.1-3.9.1 |
chrony SUSE:Linux Enterprise Micro 5.1 | All versions | 4.1-150300.16.3.1 |
augeas SUSE:Linux Enterprise Micro 5.2 | All versions | 1.10.1-3.9.1 |
augeas SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 1.10.1-3.9.1 |
chrony SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 4.1-150300.16.3.1 |
augeas SUSE:Linux Enterprise Real Time 15 SP2 | All versions | 1.10.1-3.9.1 |
chrony SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 4.1-5.9.1 |
chrony SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 4.1-5.9.1 |
chrony SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 4.1-5.9.1 |
chrony SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 4.1-5.9.1 |
chrony SUSE:Linux Enterprise Server 12 SP5 | All versions | 4.1-5.9.1 |
chrony SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 4.1-5.9.1 |
chrony SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 4.1-5.9.1 |
chrony SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 4.1-5.9.1 |
chrony SUSE:OpenStack Cloud 8 | All versions | 4.1-5.9.1 |
chrony SUSE:OpenStack Cloud 9 | All versions | 4.1-5.9.1 |
chrony SUSE:OpenStack Cloud Crowbar 8 | All versions | 4.1-5.9.1 |
chrony SUSE:OpenStack Cloud Crowbar 9 | All versions | 4.1-5.9.1 |
augeas openSUSE:Leap 15.3 | All versions | 1.10.1-3.9.1 |
chrony openSUSE:Leap 15.3 | All versions | 4.1-150300.16.3.1 |
chrony openSUSE:Tumbleweed | All versions | 4.1-5.2 |
Products include Canonical Ubuntu Linux, Fedoraproject Fedora, Tuxfamily Chrony.
How do I fix CVE-2020-14367?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-14367 being exploited?
There is no known exploitation of CVE-2020-14367 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2020-14367, DEBIAN-CVE-2020-14367, GHSA-73h7-c2xm-9mrv, MGASA-2020-0341, SUSE-SU-2021:4147-1, SUSE-SU-2022:0845-1 and 5 more.