PT-2020-2777 · Teejee+2 · Timeshift+2

Matthias Gerstner · Published 2020-03-05 · Updated 2022-01-01 · CVE-2020-10174

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Timeshift versions prior to 20.03

Description The issue is caused by errors in synchronization when using a shared resource in the init tmp function of TeeJee.FileSystem.vala in Timeshift. This allows an attacker to execute arbitrary code by winning a race condition to replace scripts created by Timeshift with attacker-controlled scripts, which are then executed with full root privileges. Timeshift is a backup system that uses rsync or Btrfs snapshots, providing functionality similar to System Restore in Windows and Time Machine in macOS.

Recommendations For versions prior to 20.03, update to version 20.03 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp/timeshift location to minimize the risk of exploitation. Avoid using Timeshift until the issue is resolved, as the logic is practically always triggered when Timeshift runs, regardless of the command-line arguments used.

Fix

Link Following

Race Condition

Weakness Enumeration

CWE-59

CWE-362

Related Identifiers

ALT-PU-2020-1431

ALT-PU-2020-1554

BDU:2020-02872

CVE-2020-10174

Affected Products

Alt Linux

Timeshift

Ubuntu

References · 23

• https://github.com/teejee2008/timeshift/commit/335b3d5398079278b8f7094c77bfd148b315b462 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-10174 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TXXYQFSZ5P6ZMNFIDBAQKBFZIR2T7ZLL · Vendor Advisory
• https://usn.ubuntu.com/4312-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SXDEPC52G46U6I7GLQNFLZXVSM7V2HYY · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAOFXT64CEUMJE3723JDJWTEQWQUCYMD · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-10174 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/SXDEPC52G46U6I7GLQNFLZXVSM7V2HYY · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10174 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02872 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXXYQFSZ5P6ZMNFIDBAQKBFZIR2T7ZLL · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AAOFXT64CEUMJE3723JDJWTEQWQUCYMD · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-10174 · Vendor Advisory
• https://github.com/teejee2008/timeshift/releases/tag/v20.03 · Note
• http://openwall.com/lists/oss-security/2020/03/06/3 · Note