CVE-2020-8013 permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim

Low 2.2 Published 2 Mar 2020 Updated 16 Sep 2024

chkstat erroneously follows symlinks, potentially setting unintended setuid or capabilities on other binaries, allowing local privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2020-8013?

CVE-2020-8013 is a low-severity path traversal vulnerability in Opensuse Leap, published on 2 Mar 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.

Weakness: CWE-59

Which versions are affected by CVE-2020-8013?

It affects 2 products.

Linux distribution packages (19)

`permissions` SUSE:Enterprise Storage 5	All versions	`2015.09.28.1626-17.27.1`
`permissions` SUSE:HPE Helion OpenStack 8	All versions	`2015.09.28.1626-17.27.1`
`permissions` SUSE:Linux Enterprise Desktop 12 SP4	All versions	`20170707-3.21.1`
`permissions` SUSE:Linux Enterprise Point of Sale 11 SP3	All versions	`2013.1.7-0.6.12.1`
`permissions` SUSE:Linux Enterprise Server 11 SP4-LTSS	All versions	`2013.1.7-0.6.12.1`
`permissions` SUSE:Linux Enterprise Server 11 SP4-LTSS	All versions	`2013.1.7-0.6.12.1`
`permissions` SUSE:Linux Enterprise Server 12 SP2-BCL	All versions	`2015.09.28.1626-17.27.1`
`permissions` SUSE:Linux Enterprise Server 12 SP2-LTSS	All versions	`2015.09.28.1626-17.27.1`
`permissions` SUSE:Linux Enterprise Server 12 SP3-BCL	All versions	`2015.09.28.1626-17.27.1`
`permissions` SUSE:Linux Enterprise Server 12 SP3-LTSS	All versions	`2015.09.28.1626-17.27.1`
`permissions` SUSE:Linux Enterprise Server 12 SP4	All versions	`20170707-3.21.1`
`permissions` SUSE:Linux Enterprise Server 12 SP5	All versions	`20170707-3.21.1`
`permissions` SUSE:Linux Enterprise Server for SAP Applications 12 SP2	All versions	`2015.09.28.1626-17.27.1`
`permissions` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`2015.09.28.1626-17.27.1`
`permissions` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	All versions	`20170707-3.21.1`
`permissions` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`20170707-3.21.1`
`permissions` SUSE:OpenStack Cloud 7	All versions	`2015.09.28.1626-17.27.1`
`permissions` SUSE:OpenStack Cloud 8	All versions	`2015.09.28.1626-17.27.1`
`permissions` SUSE:OpenStack Cloud Crowbar 8	All versions	`2015.09.28.1626-17.27.1`

Products include Opensuse Leap, Suse Linux Enterprise Server.

How do I fix CVE-2020-8013?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2020-8013 being exploited?

There is no known exploitation of CVE-2020-8013 in the wild and no public exploit code.

All Opensuse Leap vulnerabilities

Sources

Also known as GHSA-g26j-xpv7-cfwg, SUSE-RU-2020:0603-1, SUSE-RU-2020:14304-1, SUSE-SU-2020:0545-1, SUSE-SU-2020:14304-1.