CVE-2020-27187: 
Linux Debian vulnerability analysis and mitigation

An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logic flaw in which the service invoking D-Bus is not properly checked. This vulnerability was assigned CVE-2020-27187 and was discovered on October 17, 2020. The affected software is KDE Partition Manager version 4.1.0 (KDE Advisory).

The vulnerability stems from improper validation of D-Bus service requests in the kpmcore_externalcommand helper component. This security flaw allows for unauthorized manipulation of system commands and files. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

An attacker on the local machine can replace /etc/fstab and execute mount and other partitioning-related commands while KDE Partition Manager is running. The mount command can then be used to gain full root privileges, effectively allowing for complete system compromise (KDE Advisory, Gentoo Advisory).

The vulnerability requires local access to the system and can be exploited while KDE Partition Manager is running. The attack complexity is considered low, requiring minimal conditions to be successful (NVD).

The vulnerability was fixed in KDE Partition Manager 4.2.0. Users should upgrade to version 4.2.0 or later. For those unable to upgrade immediately, there are no known workarounds, and it is recommended not to use KDE Partition Manager 4.1.0 on systems with untrusted users or running untrusted software (KDE Advisory).