Arch Linux Security Advisory ASA-202010-8 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-27187 Package : kpmcore Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1253 Summary ======= The package kpmcore before version 4.2.0-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.2.0-1. # pacman -Syu "kpmcore>=4.2.0-1" The problem has been fixed upstream in version 4.2.0. Workaround ========== None. Description =========== kpmcore_externalcommand helper contains a logic flaw in which the service invoking dbus is not properly checked. An attacker on your local machine can replace /etc/fstab, execute mount and other partitioning related commands while KDE Partition Manager is running. mount command can then be used to gain full root privileges. Impact ====== A local attacker is able to escalate privileges, modify the filesystem and launch partition commands on the host while the program is running. References ========== https://kde.org/info/security/advisory-20201017-1.txt https://invent.kde.org/system/kpmcore/-/commit/c466c5db11b5cee546d1ec0594c2f... https://invent.kde.org/system/kpmcore/-/commit/7ec4b611dcf822439b081613cca41... https://security.archlinux.org/CVE-2020-27187