Google Cloud Platform guest-oslogin up to 20200507 roles/compute.osLogin default permission

Summaryinfo

A vulnerability marked as critical has been reported in Google Cloud Platform guest-oslogin up to 20200507. This issue affects some unknown processing of the file roles/compute.osLogin. Performing a manipulation results in default permission. This vulnerability is identified as CVE-2020-8933. The attack is only possible with local access. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Google Cloud Platform guest-oslogin up to 20200507 (Cloud Software). This affects an unknown code of the file roles/compute.osLogin. The manipulation with an unknown input leads to a default permission vulnerability. CWE is classifying the issue as CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using the membership to the "lxd" group, an attacker can attach host devices and filesystems. Within an lxc container, it is possible to attach the host OS filesystem and modify /etc/sudoers to then gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "lxd" user from the OS Login entry.

The weakness was released 06/22/2020 (GitHub Repository). The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2020-8933 since 02/12/2020. An attack has to be approached locally. A authentication is needed for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 06/23/2020). MITRE ATT&CK project uses the attack technique T1222 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-157159 and VDB-157160. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Google

Name

• Cloud Platform guest-oslogin

Version

• 20200507

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion