PT-2020-20360 · Google Cloud Platform+1 · Guest-Oslogin+1

Chris Moberly + 1 · Published 2020-06-22 · Updated 2024-05-21 · CVE-2020-8903

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Cloud Platform's guest-oslogin versions 20190304 through 20200507

Description A vulnerability in Google Cloud Platform's guest-oslogin allows a user with the role "roles/compute.osLogin" to escalate privileges to root. This is achieved by using their membership to the "adm" group to read the DHCP XID from the systemd journal, then setting the IP address and hostname of the instance to any value, which is stored in /etc/hosts. An attacker can then impersonate the GCE metadata server by pointing metadata.google.internal to an arbitrary IP address, making it possible to instruct the OS Login PAM module to grant administrative privileges.

Recommendations For versions 20190304 through 20200507, edit /etc/group/security.conf and remove the "adm" user from the OS Login entry if an update is not possible. For all affected versions, update to an image created after 2020-May-07 (20200507) to resolve the issue.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-8903

OPENSUSE-SU-2020:0996-1

OPENSUSE-SU-2020:1014-1

OPENSUSE-SU-2020_0996-1

OPENSUSE-SU-2020_1014-1

SUSE-SU-2020:1934-1

SUSE-SU-2020:2200-1

SUSE-SU-2020_1934-1

SUSE-SU-2020_2200-1

Affected Products

Suse

Guest-Oslogin

References · 25

• 🔥 https://gitlab.com/gitlab-com/gl-security/gl-redteam/red-team-tech-notes/-/tree/master/oslogin-privesc-june-2020 · Exploit
• https://github.com/GoogleCloudPlatform/guest-oslogin/pull/29 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-8903 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-8903 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00037.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8903 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0996-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8903 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00047.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8903 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1014-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2200-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1934-1 · Vendor Advisory
• https://cloud.google.com/support/bulletins/#gcp-2020-008 · Vendor Advisory
• https://suse.com/security/cve/CVE-2020-8903 · Note