Illfelder

**Name of the Vulnerable Software and Affected Versions** Google Cloud Platform's guest-oslogin versions 20190304 through 20200507 **Description** A vulnerability in Google Cloud Platform's guest-oslogin allows a user with the role "roles/compute.osLogin" to escalate privileges to root. This is achieved by using their membership to the "adm" group to read the DHCP XID from the systemd journal, then setting the IP address and hostname of the instance to any value, which is stored in /etc/hosts. An attacker can then impersonate the GCE metadata server by pointing metadata.google.internal to an arbitrary IP address, making it possible to instruct the OS Login PAM module to grant administrative privileges. **Recommendations** For versions 20190304 through 20200507, edit /etc/group/security.conf and remove the "adm" user from the OS Login entry if an update is not possible. For all affected versions, update to an image created after 2020-May-07 (20200507) to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 Description: A vulnerability in Google Cloud Platform's guest-oslogin allows a user with the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "docker" group, an attacker with this role is able to run docker and mount the host OS. Within docker, it is possible to modify the host OS filesystem and modify /etc/groups to gain administrative privileges. Recommendations: For versions between 20190304 and 20200507, if an update to a newer version is not possible, edit /etc/group/security.conf and remove the "docker" user from the OS Login entry to mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability, but it is known that all images created after 2020-May-07 are fixed.

Name of the Vulnerable Software and Affected Versions: Google Cloud OS guest-oslogin versions 20190304 through 20200507 Description: The issue is related to incorrect default permission settings in the guest-oslogin feature of Google Cloud OS. This allows an attacker to escalate privileges to root. By being a member of the `lxd` group, an attacker can attach host devices and filesystems. Within an `lxc` container, it is possible to attach the host OS filesystem and modify `/etc/sudoers` to gain administrative privileges. Recommendations: For versions 20190304 through 20200507, update to an image created after 2020-May-07. As a temporary workaround for versions that cannot be updated, edit `/etc/group/security.conf` and remove the `lxd` user from the OS Login entry.