Skip to content
Fencer Intel
high 7.8

CVE-2020-8933 json

Priviged Escalation in Google Cloud Platform's Guest-OSLogin

published 6y ago modified 4mo ago also EUVD-2020-29764

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits
0
none known

Summary

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using the membership to the "lxd" group, an attacker can attach host devices and filesystems. Within an lxc container, it is possible to attach the host OS filesystem and modify /etc/sudoers to then gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "lxd" user from the OS Login entry.

Patch / fix

  • Google LLC guest-oslogin 20200507
  • google guest-oslogin 20200507
  • gce-compute-image-packages Ubuntu 16.04 LTS 20190801-0ubuntu1~16.04.1
  • gce-compute-image-packages Ubuntu 18.04 LTS 20190801-0ubuntu1~18.04.1
  • gce-compute-image-packages Ubuntu 20.04 LTS 20190801-0ubuntu4.1

ubuntu advisories UBUNTU-CVE-2020-8933

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • google-compute-engine SLE Module for Public Cloud 12 20190801-54.1
  • google-compute-engine SLE Module for Public Cloud 15 SP2, SLE Module for Public Cloud 15 SP1 20190801-4.38.1

suse advisories SUSE-SU-2020:2200-1SUSE-SU-2020:1934-1

  • google-compute-engine openSUSE Leap 15.2 20190801-lp152.5.4.1
  • google-compute-engine openSUSE Leap 15.1 20190801-lp151.2.25.1

opensuse advisories openSUSE-SU-2020:1014-1openSUSE-SU-2020:0996-1

Is CVE-2020-8933 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2y ago

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • gitlab.com https://gitlab.com/gitlab-com/gl-security/gl-redteam/red-team-tech-notes/-/tree/master/oslogin-privesc-june-2020 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.3 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA 4.0 9.3 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • Google LLC guest-oslogin
  • google guest-oslogin

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.