Vulnerability in Timeshift Project
CVE-2020-10174
init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely reuses a preexisting temporary directory in the predictable location /tmp/timeshift. It follows symlinks in this location or uses directories owned by unprivileged users. Because Timeshift also executes scripts under this location, an attacker can attempt to win a race condition to replace scripts created by Timeshift with attacker-controlled scripts. Upon success, an attacker-controlled script is executed with full root privileges. This logic is practically always triggered when Timeshift runs regardless of the command-line arguments used.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (18.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 18th percentile — 18.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Timeshift Project
- Canonical Ubuntu Linux — versions 19.10
- Fedoraproject Fedora — versions 30, 31, 32
Weakness classification (CWE)
References
- bugzilla.suse.com/show_bug.cgi (Third Party Advisory, Issue Tracking)
- github.com/teejee2008/timeshift/commit/335b3d5398079278b8f7094c77bfd148b315b462 (Patch, Third Party Advisory)
- github.com/teejee2008/timeshift/releases/tag/v20.03 (Third Party Advisory, Release Notes)
- www.openwall.com/lists/oss-security/2020/03/06/3 (mailing-list, Mailing List, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- usn.ubuntu.com/4312-1/ (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-10174?
- CVE-2020-10174 is a high-severity vulnerability in Timeshift Project, classified under Improper Link Resolution Before File Access. CVSS score: 7.0/10. Published 2020-03-05.
- How severe is CVE-2020-10174?
- High severity. CVSS v3 base score is 7.0 out of 10.