Skip to content
Fencer Vulns
high 7.8

CVE-2020-8903 json

Priviged Escalation in Google Cloud Platform's Guest-OSLogin

published 2020-06-22 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-29742

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits
0
none known

Summary

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "adm" group, users with this role are able to read the DHCP XID from the systemd journal. Using the DHCP XID, it is then possible to set the IP address and hostname of the instance to any value, which is then stored in /etc/hosts. An attacker can then point metadata.google.internal to an arbitrary IP address and impersonate the GCE metadata server which make it is possible to instruct the OS Login PAM module to grant administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "adm" user from the OS Login entry.

Patch / fix

  • Google LLC guest-oslogin 20200507
  • gce-compute-image-packages Ubuntu 16.04 LTS 20190801-0ubuntu1~16.04.1
  • gce-compute-image-packages Ubuntu 18.04 LTS 20190801-0ubuntu1~18.04.1
  • gce-compute-image-packages Ubuntu 20.04 LTS 20190801-0ubuntu4.1

ubuntu advisories UBUNTU-CVE-2020-8903

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • google-compute-engine SLE Module for Public Cloud 12 20190801-54.1
  • google-compute-engine SLE Module for Public Cloud 15 SP2, SLE Module for Public Cloud 15 SP1 20190801-4.38.1

suse advisories SUSE-SU-2020:2200-1SUSE-SU-2020:1934-1

  • google-compute-engine openSUSE Leap 15.2 20190801-lp152.5.4.1
  • google-compute-engine openSUSE Leap 15.1 20190801-lp151.2.25.1

opensuse advisories openSUSE-SU-2020:1014-1openSUSE-SU-2020:0996-1

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gitlab.com https://gitlab.com/gitlab-com/gl-security/gl-redteam/red-team-tech-notes/-/tree/master/oslogin-privesc-june-2020 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA 4.0 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • Google LLC guest-oslogin

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.