CVE-2020-10174

init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely
reuses a preexisting temporary directory in the predictable location
/tmp/timeshift. It follows symlinks in this location or uses directories
owned by unprivileged users. Because Timeshift also executes scripts under
this location, an attacker can attempt to win a race condition to replace
scripts created by Timeshift with attacker-controlled scripts. Upon
success, an attacker-controlled script is executed with full root
privileges. This logic is practically always triggered when Timeshift runs
regardless of the command-line arguments used.

Bugs

• <https://bugs.launchpad.net/ubuntu/+source/timeshift/+bug/1867564&gt;