CVE-2020-10174

timeshift project timeshift, fedoraproject fedora, canonical ubuntu linux

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2020-10174

Katalog CVE

CVSS 7.0 · High EPSS 0,28%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada timeshift project timeshift, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely reuses a preexisting temporary directory in the predictable location /tmp/timeshift. It follows symlinks in this location or uses directories owned by unprivileged users. Because Timeshift also executes scripts under this location, an attacker can attempt to win a race condition to replace scripts created by Timeshift with attacker-controlled scripts. Upon success, an attacker-controlled script is executed with full root privileges. This logic is practically always triggered when Timeshift runs regardless of the command-line arguments used.

Rincian

Terbit di NVD
5 Maret 2020
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
EPSS (30 hari)
0,28% peluang dieksploitasi; lebih tinggi dari 18,9% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
timeshift project timeshift Semua versi sebelum 20.03
fedoraproject fedora Versi 30
fedoraproject fedora Versi 31
fedoraproject fedora Versi 32
canonical ubuntu linux Versi 19.10

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.