CVE-2020-8025 outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues
Incorrect directory permissions in the PCP package allow local attackers to access or modify sensitive data, requiring a permissions package update.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-8025?
CVE-2020-8025 is a medium-severity vulnerability in Suse Linux Enterprise Server, published on 7 Aug 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.
Weakness: CWE-279
Which versions are affected by CVE-2020-8025?
It affects 3 products.
Linux distribution packages (8)
pcp SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 3.11.9-5.11.5 |
pcp SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 3.11.9-5.11.5 |
permissions SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 20181224-23.3.1 |
pcp SUSE:Linux Enterprise Server 15-LTSS | All versions | 3.11.9-5.11.5 |
pcp SUSE:Linux Enterprise Server for SAP Applications 15 | All versions | 3.11.9-5.11.5 |
pcp SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 3.11.9-6.17.1 |
pcp openSUSE:Leap 15.3 | All versions | 3.11.9-150000.5.14.1 |
pcp openSUSE:Leap 15.4 | All versions | 3.11.9-150000.5.14.1 |
Products include Suse Linux Enterprise High Performance Computing, Suse Linux Enterprise Server, Suse Linux Enterprise Software Development Kit.
How do I fix CVE-2020-8025?
Apply the vendor's patch.
Is CVE-2020-8025 being exploited?
There is no known exploitation of CVE-2020-8025 in the wild and no public exploit code.
Sources
Also known as GHSA-g55h-q572-52j6, SUSE-SU-2021:0197-1, SUSE-SU-2021:1292-1, SUSE-SU-2022:1509-1, SUSE-SU-2022:1873-1.