CVE-2020-27187: High severity kde partition manager vulnerability
An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcoreexternalcommand helper contains a logic flaw in which the service invoking D-Bus is not properly checked. An attacker on the local machine can replace /etc/fstab, and execute mount and other partitioning related commands, while KDE Partition Manager is running. the mount command can then be used to gain full root privileges.
Other sources
kpmcoreexternalcommand helper contains a logic flaw in which the service invoking dbus is not properly checked. An attacker on your local machine can replace /etc/fstab, execute mount and other partitioning related commands while KDE Partition Manager is running. mount command can then be used to gain full root privileges.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-27187?
CVE-2020-27187 is an issue discovered in KDE Partition Manager 4.1.0 before 4.2.0, where the kpmcore_externalcommand helper contains a logic flaw that allows an attacker on the local machine to replace /etc/fstab and execute mount and other partitioning related commands.
What is the severity of CVE-2020-27187?
CVE-2020-27187 has a severity rating of 7.8 (high).
How can I fix CVE-2020-27187?
To fix CVE-2020-27187, update KDE Partition Manager to version 4.2.0 or later.
Where can I find more information about CVE-2020-27187?
You can find more information about CVE-2020-27187 on the Red Hat Bugzilla page and the KDE security advisory.
Is there a patch available for CVE-2020-27187?
Yes, the patch for CVE-2020-27187 is included in KDE Partition Manager version 4.2.0.