A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using the membership to the "lxd" group, an attacker can attach host devices and filesystems. Within an lxc container, it is possible to attach the host OS filesystem and modify /etc/sudoers to then gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "lxd" user from the OS Login entry.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a     user that is only granted the role roles/compute.osLogin to escalate privileges to root. Using the     membership to the lxd group, an attacker can attach host devices and filesystems. Within an lxc     container, it is possible to attach the host OS filesystem and modify /etc/sudoers to then gain     administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot     update, we recommend you edit /etc/group/security.conf and remove the lxd user from the OS Login entry.
    (CVE-2020-8933)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for google-compute-engine fixes the following issues :

  - Don't enable and start google-network-daemon.service     when it's already installed (bsc#1169978)

  + Do not add the created user to the adm (CVE-2020-8903),     docker (CVE-2020-8907), or lxd (CVE-2020-8933) groups if     they exist (bsc#1173258) This update was imported from     the SUSE:SLE-15:Update update project.

This update for google-compute-engine fixes the following issues :

  - Don't enable and start google-network-daemon.service     when it's already installed (bsc#1169978)

  + Do not add the created user to the adm (CVE-2020-8903),     docker (CVE-2020-8907), or lxd (CVE-2020-8933) groups if     they exist (bsc#1173258)

ID	Name	Product	Family	Severity
262936	Linux Distros Unpatched Vulnerability : CVE-2020-8933	Nessus	Misc.	high
138755	openSUSE Security Update : google-compute-engine (openSUSE-2020-996)	Nessus	SuSE Local Security Checks	high
138674	openSUSE Security Update : google-compute-engine (openSUSE-2020-1014)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-8933

critical

Tenable Plugins

high

high

high