CVE-2020-24330: 
NixOS vulnerability analysis and mitigation

CVE-2020-24330 affects TrouSerS through version 0.3.14. The vulnerability was discovered in 2020 and involves a privilege escalation issue where if the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed (NVD, OSS Security).

The vulnerability occurs in the privilege dropping mechanism of the tcsd daemon. When started with root privileges, the daemon only drops the root uid via setuid() but not the root group id, allowing it to continue running with root group privileges that exceed what it actually requires. This issue is present in the main() function where setgid() is missing from the privilege dropping sequence (OSS Security). The vulnerability has been assigned a CVSS v3.1 base score of 7.8 HIGH with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The retained root group privileges could potentially allow privilege escalations when combined with other attack vectors. This means a compromised tcsd process could leverage these excessive privileges to perform actions beyond its intended scope (OSS Security).

The vulnerability requires local access and can be exploited when the tcsd daemon is started with root privileges via systemd or similar mechanisms, as was the case in SUSE and Fedora Linux distributions at the time of discovery (OSS Security).

The recommended mitigation is to run the tcsd daemon directly as the tss:tss user and group instead of relying on the privilege drop logic. This requires setting appropriate permissions for /var/lib/tpm and the /dev/tpm0 device via udev rules. For systems that must start tcsd as root, patches have been released that add the missing setgid() call to drop root group privileges (OSS Security, SUSE).

The vulnerability was initially reported to IBM (the upstream maintainer) in February 2020. After reaching the 90-day disclosure deadline without a response, it was publicly disclosed in May 2020. Major Linux distributions including SUSE and Red Hat have released security updates to address the vulnerability (OSS Security, Red Hat).