Google Cloud Platform guest-oslogin up to 20200507 roles/compute.osLogin default permission

Summaryinfo

A vulnerability labeled as critical has been found in Google Cloud Platform guest-oslogin up to 20200507. This vulnerability affects unknown code of the file roles/compute.osLogin. Such manipulation leads to default permission. This vulnerability is referenced as CVE-2020-8907. The attack can only be performed from a local environment. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Google Cloud Platform guest-oslogin up to 20200507 (Cloud Software). Affected by this issue is an unknown part of the file roles/compute.osLogin. The manipulation with an unknown input leads to a default permission vulnerability. Using CWE to declare the problem leads to CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "docker" group, an attacker with this role is able to run docker and mount the host OS. Within docker, it is possible to modify the host OS filesystem and modify /etc/groups to gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "docker" user from the OS Login entry.

The weakness was published 06/22/2020 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability is handled as CVE-2020-8907 since 02/12/2020. The attack needs to be approached locally. A simple authentication is necessary for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 06/23/2020). The MITRE ATT&CK project declares the attack technique as T1222.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-157159 and VDB-157161. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Cloud Software

Vendor

• Google

Name

• Cloud Platform guest-oslogin

Version

• 20200507

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion