CVE-2020-8933 Priviged Escalation in Google Cloud Platform's Guest-OSLogin

Critical 9.3 Published 22 Jun 2020 Updated 4 Aug 2024

A user with OS Login role can escalate to root by exploiting LXD group membership to modify host sudoers, affecting GCP instances.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2020-8933?

CVE-2020-8933 is a critical vulnerability in Opensuse Leap, published on 22 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using the membership to the "lxd" group, an attacker can attach host devices and filesystems. Within an lxc container, it is possible to attach the host OS filesystem and modify /etc/sudoers to then gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "lxd" user from the OS Login entry.

Weakness: CWE-276

Which versions are affected by CVE-2020-8933?

It affects 2 products.

Products include Google Guest-Oslogin, Opensuse Leap.

How do I fix CVE-2020-8933?

Upgrade to a fixed version.

Is CVE-2020-8933 being exploited?

There is no known exploitation of CVE-2020-8933 in the wild and no public exploit code.

All Opensuse Leap vulnerabilities

Sources

Also known as GHSA-29jr-2926-3w9p, UBUNTU-CVE-2020-8933.