CVE-2020-8933

CVE-2020-8933 affects Google Cloud Platform’s guest-oslogin (versions 20190304–20200507). The flaw lets a user with roles/compute.osLogin escalate to root by abusing the lxd group to attach host devices/filesystems and modify /etc/sudoers within an lxc container; images created after 2020-05-07 a...

CVE-2020-8903

CVE-2020-8903 affects Google Cloud Platform's guest-oslogin in versions 20190304–20200507, enabling a user with roles/compute.osLogin to escalate to root by abusing membership in the adm group to read the DHCP XID, modify IP/hostname in /etc/hosts, redirect metadata.google.internal to an arbitrar...

CVE-2020-8907

CVE-2020-8907 affects Google Cloud Platform’s guest-oslogin (versions between 20190304 and 20200507). A user with only the roles/compute.osLogin role can escalate to root by using their membership in the docker group to run docker, mount the host OS, and modify the host filesystem (including /etc...