Lucene search

K
archlinuxArchLinuxASA-202010-8
HistoryOct 18, 2020 - 12:00 a.m.

[ASA-202010-8] kpmcore: privilege escalation

2020-10-1800:00:00
security.archlinux.org
5

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.1%

Arch Linux Security Advisory ASA-202010-8

Severity: High
Date : 2020-10-18
CVE-ID : CVE-2020-27187
Package : kpmcore
Type : privilege escalation
Remote : No
Link : https://security.archlinux.org/AVG-1253

Summary

The package kpmcore before version 4.2.0-1 is vulnerable to privilege
escalation.

Resolution

Upgrade to 4.2.0-1.

pacman -Syu “kpmcore>=4.2.0-1”

The problem has been fixed upstream in version 4.2.0.

Workaround

None.

Description

kpmcore_externalcommand helper contains a logic flaw in which the
service invoking dbus is not properly checked. An attacker on your
local machine can replace /etc/fstab, execute mount and other
partitioning related commands while KDE Partition Manager is running.
mount command can then be used to gain full root privileges.

Impact

A local attacker is able to escalate privileges, modify the filesystem
and launch partition commands on the host while the program is running.

References

https://kde.org/info/security/advisory-20201017-1.txt
https://invent.kde.org/system/kpmcore/-/commit/c466c5db11b5cee546d1ec0594c2f1105a354fed
https://invent.kde.org/system/kpmcore/-/commit/7ec4b611dcf822439b081613cca4184689266454
https://security.archlinux.org/CVE-2020-27187

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanykpmcore< 4.2.0-1UNKNOWN

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.1%