CVE-2020-21583 Command injection in n/a

What is CVE-2020-21583?

CVE-2020-21583 is a medium-severity command injection vulnerability in n/a, published on 22 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.

Weakness: CWE-78

Which versions are affected by CVE-2020-21583?

It affects 1 product.

Products include Kernel Util-Linux.

How do I fix CVE-2020-21583?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-21583 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-21583 exists.

Other vulnerabilities in n/a

• CVE-2015-5224 Race condition in n/a Critical 9.8
• CVE-2018-7738 Command injection in n/a High 7.8
• CVE-2016-2779 Privilege escalation in n/a High 7.8
• CVE-2026-13595 Util-linux: util-linux: heap use-after-free in libblkid nested partition probing Medium 6.8
• CVE-2022-0563 Information disclosure in util-linux Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2020-21583, GHSA-c5mr-x8m3-hpc9, UBUNTU-CVE-2020-21583.