CVE-2020-24330 Privilege escalation in n/a
Attackers can gain root privileges if the tcsd daemon is started as root instead of the tss user, failing to drop privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-24330?
CVE-2020-24330 is a high-severity vulnerability in Fedoraproject Fedora, published on 13 Aug 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.
Weakness: CWE-269
Which versions are affected by CVE-2020-24330?
It affects 2 products.
Linux distribution packages (5)
trousers SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 0.3.14-150000.3.3.1 |
trousers SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 0.3.14-150000.3.3.1 |
trousers SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 0.3.13-3.3.1 |
trousers SUSE:Linux Enterprise Server 15-LTSS | All versions | 0.3.14-150000.3.3.1 |
trousers SUSE:Linux Enterprise Server for SAP Applications 15 | All versions | 0.3.14-150000.3.3.1 |
Products include Fedoraproject Fedora, Trousers Project Trousers.
How do I fix CVE-2020-24330?
Apply the vendor's patch.
Is CVE-2020-24330 being exploited?
There is no known exploitation of CVE-2020-24330 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-6925, DEBIAN-CVE-2020-24330, GHSA-phqh-fwjq-q59q, SUSE-SU-2022:2798-1, SUSE-SU-2022:2800-1, UBUNTU-CVE-2020-24330.