CVE-2020-21583
Publication date 22 August 2023
Last updated 24 July 2024
Ubuntu priority
An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.
Read the notes from the security team
Why is this CVE low priority?
Non-default and improbable configuration
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| util-linux | 24.10 oracular |
Not affected
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Vulnerable
|
Notes
mdeslaur
This is only an issue when hwclock was modified by the administrator to be setuid root, which should never be done. Ubuntu packages are not shipped with the setuid bit set. To prevent misconfiguration, version 2.27 now prevent it from being run setuid.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
6.7 · Medium
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | High |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |