UNIX symbolic link following in swtpm - CVE-2020-28407

Vulnerability identifier: #VU48570

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-28407

CWE-ID: CWE-61

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a symlink following issue. A local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.

Successful exploitation of this vulnerability may result in privilege escalation.

swtpm
Arch Linux
openEuler
Fedora
swtpm
swtpm-libs
swtpm-debugsource
swtpm-debuginfo
swtpm-tools
swtpm-devel

Install updates from vendor's website.

swtpm - update to 0.5.1
swtpm - update to 0.3.3-5
swtpm-libs - update to 0.3.3-5
swtpm-debugsource - update to 0.3.3-5
swtpm-debuginfo - update to 0.3.3-5
swtpm-tools - update to 0.3.3-5
swtpm-devel - update to 0.3.3-5
swtpm - addressed in versions 0.5.1-1.20201113git390f5bd.fc31, 0.5.1-1.20201113git390f5bd.fc32, 0.5.1-1.20201113git390f5bd.fc33

• https://github.com/stefanberger/swtpm/compare/v0.5.0...v0.5.1
• https://security.archlinux.org/advisory/ASA-202011-21

• Privilege escalation in swtpm
• Arch Linux update for swtpm
• openEuler update for swtpm
• Fedora 33 update for swtpm
• Fedora 32 update for swtpm
• Fedora 31 update for swtpm