Arch Linux alert ASA-202010-8 (kpmcore)

From:
             
 
Morten Linderud <foxboron@archlinux.org>
To:
             
 
arch-security@archlinux.org
Subject:
             
 
[ASA-202010-8] kpmcore: privilege escalation
Date:
             
 
Wed, 21 Oct 2020 09:06:13 +0200
Message-ID:
             
 
<20201021070613.zkagxsjfzzlsr7ft@anathema>
Arch Linux Security Advisory ASA-202010-8
=========================================

Severity: High
Date    : 2020-10-18
CVE-ID  : CVE-2020-27187
Package : kpmcore
Type    : privilege escalation
Remote  : No
Link    : https://security.archlinux.org/AVG-1253

Summary
=======

The package kpmcore before version 4.2.0-1 is vulnerable to privilege
escalation.

Resolution
==========

Upgrade to 4.2.0-1.

# pacman -Syu "kpmcore>=4.2.0-1"

The problem has been fixed upstream in version 4.2.0.

Workaround
==========

None.

Description
===========

kpmcore_externalcommand helper contains a logic flaw in which the
service invoking dbus is not properly checked. An attacker on your
local machine can replace /etc/fstab, execute mount and other
partitioning related commands while KDE Partition Manager is running.
mount command can then be used to gain full root privileges.

Impact
======

A local attacker is able to escalate privileges, modify the filesystem
and launch partition commands on the host while the program is running.

References
==========

https://kde.org/info/security/advisory-20201017-1.txt
https://invent.kde.org/system/kpmcore/-/commit/c466c5db11...
https://invent.kde.org/system/kpmcore/-/commit/7ec4b611dc...
https://security.archlinux.org/CVE-2020-27187