CVE-2020-10174

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-10174

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10174.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-10174

Downstream

DEBIAN-CVE-2020-10174

Published

2020-03-05T16:15:11.940Z

Modified

2026-03-14T14:42:10.250345Z

Severity

7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely reuses a preexisting temporary directory in the predictable location /tmp/timeshift. It follows symlinks in this location or uses directories owned by unprivileged users. Because Timeshift also executes scripts under this location, an attacker can attempt to win a race condition to replace scripts created by Timeshift with attacker-controlled scripts. Upon success, an attacker-controlled script is executed with full root privileges. This logic is practically always triggered when Timeshift runs regardless of the command-line arguments used.

References

Affected packages

Git / github.com/teejee2008/timeshift

Affected ranges

Type

GIT

Repo

https://github.com/teejee2008/timeshift

Events

Introduced

Fixed

cecd294dcaea9bcf282865268dc6667fbeeeddb3

Fixed

335b3d5398079278b8f7094c77bfd148b315b462

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "20.03"
        }
    ]
}

Affected versions

v17.*

v17.10

v17.11

v17.2

v18.*

v18.1

v18.1.1

v18.2

v18.4

v18.6

v18.6.1

v18.8

v18.9

v18.9.1

v19.*

v19.01

v19.08.1

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "30"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "31"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "19.10"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10174.json"