CVE-2020-24331 Privilege escalation in n/a
A local attacker with tss user access can modify the tcsd configuration file to potentially escalate privileges when the daemon runs as root.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-24331?
CVE-2020-24331 is a high-severity vulnerability in Fedoraproject Fedora, published on 13 Aug 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).
Weakness: CWE-269
Which versions are affected by CVE-2020-24331?
It affects 2 products.
Products include Fedoraproject Fedora, Trousers Project Trousers.
How do I fix CVE-2020-24331?
Apply the vendor's patch.
Is CVE-2020-24331 being exploited?
There is no known exploitation of CVE-2020-24331 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-6926, DEBIAN-CVE-2020-24331, GHSA-92g6-rx66-6q4j, UBUNTU-CVE-2020-24331.