gce-compute-image-packages: A vulnerability in Google Cloud Platform's guest-oslogin versions between20190304 and 20200507 allows a user that is...
CVE-2020-8933 is fixed in 5 products on 1 platform, first by gce-compute-image-packages 20190801-0ubuntu1~18.04.1, released June 22, 2020. It is not reported as exploited. Patch Radar priority: Routine.
A vulnerability in Google Cloud Platform's guest-oslogin versions between20190304 and 20200507 allows a user that is only granted the role"roles/compute.osLogin" to escalate privileges to root. Using themembership to the "lxd" group, an attacker can attach host devices andfilesystems. Within an lxc container, it is possible to attach the host OSfilesystem and modify /etc/sudoers to then gain administrative privileges.All images created after 2020-May-07 (20200507) are fixed, and if youcannot update, we recommend you edit /etc/group/security.conf and removethe "lxd" user from the OS Login entry.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| gce-compute-image-packages · Ubuntu 18.04.6 LTS (bionic) | 20190801-0ubuntu1~18.04.1 | gce-compute-image-packages 20190801-0ubuntu1~18.04.1 | Jun 22, 2020 |
| gce-compute-image-packages · Ubuntu 20.04 LTS (focal) | 20190801-0ubuntu4.1 | gce-compute-image-packages 20190801-0ubuntu4.1 | Jun 22, 2020 |
| gce-compute-image-packages · Ubuntu 24.10 (oracular) | 20190801-0ubuntu5 | gce-compute-image-packages 20190801-0ubuntu5 | Jan 16, 2026 |
| gce-compute-image-packages · Ubuntu 25.04 (plucky) | 20190801-0ubuntu5 | gce-compute-image-packages 20190801-0ubuntu5 | Jan 16, 2026 |
| google-compute-engine · Ubuntu 24.10 (oracular) | 20190801-0ubuntu5 | google-compute-engine 20190801-0ubuntu5 | Jan 16, 2026 |
| google-compute-engine · Ubuntu 25.04 (plucky) | 20190801-0ubuntu5 | google-compute-engine 20190801-0ubuntu5 | Jan 16, 2026 |
| google-compute-engine-oslogin · Ubuntu 18.04.6 LTS (bionic) | 20190801-0ubuntu1~18.04.1 | google-compute-engine-oslogin 20190801-0ubuntu1~18.04.1 | Jun 22, 2020 |
| google-compute-engine-oslogin · Ubuntu 20.04 LTS (focal) | 20190801-0ubuntu4.1 | google-compute-engine-oslogin 20190801-0ubuntu4.1 | Jun 22, 2020 |
| python-google-compute-engine · Ubuntu 18.04.6 LTS (bionic) | 20190801-0ubuntu1~18.04.1 | python-google-compute-engine 20190801-0ubuntu1~18.04.1 | Jun 22, 2020 |
| python3-google-compute-engine · Ubuntu 18.04.6 LTS (bionic) | 20190801-0ubuntu1~18.04.1 | python3-google-compute-engine 20190801-0ubuntu1~18.04.1 | Jun 22, 2020 |
| python3-google-compute-engine · Ubuntu 20.04 LTS (focal) | 20190801-0ubuntu4.1 | python3-google-compute-engine 20190801-0ubuntu4.1 | Jun 22, 2020 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.