CVE Vulnerability

CVE-2020-24612

An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok option (the default when configured by the authselect tool), and that file cannot be read, the second factor is disabled. An attacker with only the knowledge of the password can then log in, bypassing 2FA.

1.9 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.4 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

4.7 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1860888 Issue Tracking Third Party Advisory
https://github.com/fedora-selinux/selinux-policy/commit/71e1989028802c7875d3436fd3966c587fa383fb Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:fedoraproject:selinux-policy:*:*:*:*:*:*:*:*
Information

Published : 2020-08-24 09:15

Updated : 2020-09-01 07:02

NVD link : CVE-2020-24612

Mitre link : CVE-2020-24612

Products Affected

Fedoraproject

Selinux-policy

CWE
CWE-287