CVE-2020-8933

Name of the Vulnerable Software and Affected Versions: Google Cloud OS guest-oslogin versions 20190304 through 20200507

Description: The issue is related to incorrect default permission settings in the guest-oslogin feature of Google Cloud OS. This allows an attacker to escalate privileges to root. By being a member of the lxd group, an attacker can attach host devices and filesystems. Within an lxc container, it is possible to attach the host OS filesystem and modify /etc/sudoers to gain administrative privileges.

Recommendations: For versions 20190304 through 20200507, update to an image created after 2020-May-07. As a temporary workaround for versions that cannot be updated, edit /etc/group/security.conf and remove the lxd user from the OS Login entry.