CVE-2020-24330

 

Published at: - 13-08-2020 07:15

Last modified: - 28-04-2022 08:58

Total changes: - 3

Description

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://bugzilla.suse.com/show_bug.cgi?id=1164472
• https://sourceforge.net/p/trousers/mailman/message/37015817/
• https://seclists.org/oss-sec/2020/q2/att-135/tcsd_fixes.patch
• [oss-security] 20200814 Re: [TrouSerS-tech] Multiple Security Issues in the TrouSerS tpm1.2 tscd Daemon-Exploit, Mailing List, Third Party Advisory
• FEDORA-2020-ab3dace708-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2020-24330

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures