CVE-2020-24330: High severity ibm cloud pak for security vulnerability
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.
Other sources
TrouSerS could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw when the tcsd daemon is started with root privileges instead of by the tss user. An attacker could exploit this vulnerability to gain root privileges on the system.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-24330?
CVE-2020-24330 is a vulnerability in TrouSerS that allows a local authenticated attacker to gain elevated privileges on the system.
How does CVE-2020-24330 affect IBM Cloud Pak for Security (CP4S)?
IBM Cloud Pak for Security (CP4S) versions 1.7.2.0, 1.7.1.0, and 1.7.0.0 are affected by CVE-2020-24330.
How does CVE-2020-24330 affect Fedora?
Fedora version 33 is affected by CVE-2020-24330.
What is the severity of CVE-2020-24330?
CVE-2020-24330 has a severity rating of 7.8 (High).
How can I fix CVE-2020-24330?
To mitigate CVE-2020-24330, update TrouSerS to version 0.3.15 or higher and start the tcsd daemon as the tss user instead of root.