Timeshift up to 20.02 Temp File TeeJee.FileSystem.vala init_tmp race condition

Summaryinfo

A vulnerability, which was classified as critical, has been found in Timeshift up to 20.02. The impacted element is the function init_tmp of the file TeeJee.FileSystem.vala of the component Temp File Handler. This manipulation causes race condition. The identification of this vulnerability is CVE-2020-10174. The attack can only be executed locally. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Timeshift up to 20.02. Affected by this vulnerability is the function init_tmp of the file TeeJee.FileSystem.vala of the component Temp File Handler. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely reuses a preexisting temporary directory in the predictable location /tmp/timeshift. It follows symlinks in this location or uses directories owned by unprivileged users. Because Timeshift also executes scripts under this location, an attacker can attempt to win a race condition to replace scripts created by Timeshift with attacker-controlled scripts. Upon success, an attacker-controlled script is executed with full root privileges. This logic is practically always triggered when Timeshift runs regardless of the command-line arguments used.

The weakness was shared 03/05/2020. This vulnerability is known as CVE-2020-10174 since 03/05/2020. An attack has to be approached locally. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

Upgrading to version 20.03 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Timeshift

Version

• 20.02

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion