[ASA-202010-8] kpmcore: privilege escalation
Morten Linderud
foxboron at archlinux.org
Wed Oct 21 07:06:13 UTC 2020
Arch Linux Security Advisory ASA-202010-8
=========================================
Severity: High
Date : 2020-10-18
CVE-ID : CVE-2020-27187
Package : kpmcore
Type : privilege escalation
Remote : No
Link : https://security.archlinux.org/AVG-1253
Summary
=======
The package kpmcore before version 4.2.0-1 is vulnerable to privilege
escalation.
Resolution
==========
Upgrade to 4.2.0-1.
# pacman -Syu "kpmcore>=4.2.0-1"
The problem has been fixed upstream in version 4.2.0.
Workaround
==========
None.
Description
===========
kpmcore_externalcommand helper contains a logic flaw in which the
service invoking dbus is not properly checked. An attacker on your
local machine can replace /etc/fstab, execute mount and other
partitioning related commands while KDE Partition Manager is running.
mount command can then be used to gain full root privileges.
Impact
======
A local attacker is able to escalate privileges, modify the filesystem
and launch partition commands on the host while the program is running.
References
==========
https://kde.org/info/security/advisory-20201017-1.txt
https://invent.kde.org/system/kpmcore/-/commit/c466c5db11b5cee546d1ec0594c2f1105a354fed
https://invent.kde.org/system/kpmcore/-/commit/7ec4b611dcf822439b081613cca4184689266454
https://security.archlinux.org/CVE-2020-27187
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20201021/57edf066/attachment.sig>
More information about the arch-security
mailing list