CVE-2020-24332

Vulnerability

TrouSerS through 0.3.14 contains a vulnerability in the tcsd daemon when started with root privileges. During startup, before dropping privileges to the tss user, the daemon creates or opens the file /var/lib/tpm/system.data with O_RDWR|O_CREAT and mode 0600 [1][3]. Because the state directory /var/lib/tpm is owned by the tss user (as per default packaging), a local attacker with control of the tss account can replace this path with a symbolic link to any other file on the system [1][3]. The flaw exists in all distributions using the packaged TrouSerS, where the daemon is commonly started as root in init scripts [1].

Exploitation

An attacker who already has access to the local tss user account (for example, through another compromise of that service account) can stage a symlink attack. Before the tcsd daemon starts (or when it is restarted), the attacker creates a symbolic link at /var/lib/tpm/system.data pointing to a target file of their choice, such as a critical system file [1][3]. When tcsd runs as root and opens that path for writing, it will follow the symlink and overwrite or create the target file with 0600 permissions [3]. No additional authentication or user interaction is required beyond having the tss user account and the ability to restart or trigger the daemon startup [1].

Impact

Successful exploitation allows the attacker to corrupt arbitrary files on the system by overwriting them with the content written by tcsd, or to create new files with mode 0600 [3]. This can be leveraged to achieve a denial of service (DoS) by overwriting essential configuration or system binaries, as the corrupted file may render the system or a service inoperable [1][3]. Full privilege escalation is not directly achieved because the corrupted files are owned by root and the attacker does not control the content written, but the ability to destroy or alter critical files is sufficient for a reliable DoS attack [3].

Mitigation

No official patched release has been published by the TrouSerS upstream as of the CVE publication date (2020-08-13) [1][3]. The recommended mitigation is to avoid starting tcsd as root; instead, start it directly as the tss user and ensure /dev/tpm0 is owned by tss [1][2]. Distributions can also implement privilege dropping earlier in the startup sequence and drop both user and group privileges [1]. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the last update.