# CVE-2020-8907: gce-compute-image-packages: A vulnerability in Google Cloud Platform's guest-oslogin versions between20190304 and 20200507 allows a user that is...

CVE-2020-8907 is fixed in 5 products on 1 platform, first by gce-compute-image-packages 20190801-0ubuntu1~18.04.1, released June 22, 2020. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2020-8907
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0031
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 22, 2020

## Description

A vulnerability in Google Cloud Platform's guest-oslogin versions between20190304 and 20200507 allows a user that is only granted the role"roles/compute.osLogin" to escalate privileges to root. Using theirmembership to the "docker" group, an attacker with this role is able to rundocker and mount the host OS. Within docker, it is possible to modify thehost OS filesystem and modify /etc/groups to gain administrativeprivileges. All images created after 2020-May-07 (20200507) are fixed, andif you cannot update, we recommend you edit /etc/group/security.conf andremove the "docker" user from the OS Login entry.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | gce-compute-image-packages Ubuntu 18.04.6 LTS (bionic) | 20190801-0ubuntu1~18.04.1 | [gce-compute-image-packages 20190801-0ubuntu1~18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-gce-compute-image-packages-20190801-0ubuntu1-18.04.1.md) | Jun 22, 2020 |
| Linux | gce-compute-image-packages Ubuntu 20.04 LTS (focal) | 20190801-0ubuntu4.1 | [gce-compute-image-packages 20190801-0ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-gce-compute-image-packages-20190801-0ubuntu4.1.md) | Jun 22, 2020 |
| Linux | gce-compute-image-packages Ubuntu 24.10 (oracular) | 20190801-0ubuntu5 | [gce-compute-image-packages 20190801-0ubuntu5](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gce-compute-image-packages-20190801-0ubuntu5.md) | Jan 16, 2026 |
| Linux | gce-compute-image-packages Ubuntu 25.04 (plucky) | 20190801-0ubuntu5 | [gce-compute-image-packages 20190801-0ubuntu5](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gce-compute-image-packages-20190801-0ubuntu5.md) | Jan 16, 2026 |
| Linux | google-compute-engine Ubuntu 24.10 (oracular) | 20190801-0ubuntu5 | [google-compute-engine 20190801-0ubuntu5](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-google-compute-engine-20190801-0ubuntu5.md) | Jan 16, 2026 |
| Linux | google-compute-engine Ubuntu 25.04 (plucky) | 20190801-0ubuntu5 | [google-compute-engine 20190801-0ubuntu5](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-google-compute-engine-20190801-0ubuntu5.md) | Jan 16, 2026 |
| Linux | google-compute-engine-oslogin Ubuntu 18.04.6 LTS (bionic) | 20190801-0ubuntu1~18.04.1 | [google-compute-engine-oslogin 20190801-0ubuntu1~18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-google-compute-engine-oslogin-20190801-0ubuntu1-18.04.1.md) | Jun 22, 2020 |
| Linux | google-compute-engine-oslogin Ubuntu 20.04 LTS (focal) | 20190801-0ubuntu4.1 | [google-compute-engine-oslogin 20190801-0ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-google-compute-engine-oslogin-20190801-0ubuntu4.1.md) | Jun 22, 2020 |
| Linux | python-google-compute-engine Ubuntu 18.04.6 LTS (bionic) | 20190801-0ubuntu1~18.04.1 | [python-google-compute-engine 20190801-0ubuntu1~18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-google-compute-engine-20190801-0ubuntu1-18.04.1.md) | Jun 22, 2020 |
| Linux | python3-google-compute-engine Ubuntu 18.04.6 LTS (bionic) | 20190801-0ubuntu1~18.04.1 | [python3-google-compute-engine 20190801-0ubuntu1~18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3-google-compute-engine-20190801-0ubuntu1-18.04.1.md) | Jun 22, 2020 |
| Linux | python3-google-compute-engine Ubuntu 20.04 LTS (focal) | 20190801-0ubuntu4.1 | [python3-google-compute-engine 20190801-0ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-google-compute-engine-20190801-0ubuntu4.1.md) | Jun 22, 2020 |

---

Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.