init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely reuses a preexisting temporary directory in the predictable location /tmp/timeshift. It follows symlinks in this location or uses directories owned by unprivileged users. Because Timeshift also executes scripts under this location, an attacker can attempt to win a race condition to replace scripts created by Timeshift with attacker-controlled scripts. Upon success, an attacker-controlled script is executed with full root privileges. This logic is practically always triggered when Timeshift runs regardless of the command-line arguments used.

Matthias Gerstner discovered that Timeshift did not securely create temporary files. An attacker could exploit a race condition in Timeshift and potentially execute arbitrary commands as root.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-10174

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
135028	Ubuntu 19.10 : Timeshift vulnerability (USN-4312-1)	Nessus	Ubuntu Local Security Checks	high
134882	Fedora 30 : timeshift (2020-1050d60507)	Nessus	Fedora Local Security Checks	high
134840	Fedora 31 : timeshift (2020-6b3ae09449)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-10174

high

Tenable Plugins

high

high

high