CVE-2020-24331: 
NixOS vulnerability analysis and mitigation

An issue was discovered in TrouSerS through 0.3.14, identified as CVE-2020-24331. The vulnerability exists when the tcsd daemon is started with root privileges, where the tss user retains read and write access to the /etc/tcsd.conf file, which contains various settings related to this daemon. This vulnerability was discovered and reported in August 2020 (OSS Security).

The vulnerability stems from improper privilege management in the TrouSerS implementation. The configuration file /etc/tcsd.conf is required by the tcsd daemon to be owned by tss:tss with mode 0600, allowing the unprivileged tss user to modify all daemon-related settings, including critical paths like system_ps_file. The issue has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows the unprivileged tss user to modify daemon settings through the configuration file, which could lead to unauthorized access to system resources and potential security compromises. Since the configuration file contains various daemon settings, an attacker could manipulate these settings to affect the daemon's behavior and potentially compromise system security (SUSE Bugzilla).

The recommended mitigation is to run the tcsd daemon as the tss:tss user and group directly, rather than relying on the privilege drop logic implemented in the daemon. This requires setting up a udev rule to pass ownership of the /dev/tpm0 device to the tss user. For systems where this is not possible, the configuration file /etc/tcsd.conf should be owned by root:tss with mode 0640 to prevent unauthorized modifications. A patch has been released that adds O_NOFOLLOW to prevent symlink attacks and implements proper privilege dropping (Fedora Update).