CVE-2020-36657: 
NixOS vulnerability analysis and mitigation

CVE-2020-36657 affects uptimed versions before 0.4.6-r1 on Gentoo Linux. The vulnerability was discovered in January 2023 and allows local users with access to the uptimed user account to gain root privileges. The issue stems from an unsafe chown -R call within the /var/spool/uptimed directory (GENTOO GLSA).

The vulnerability exists in the pkg_postinst ebuild phase where unnecessary file ownership modifications are performed. The issue allows the uptimed user to change arbitrary files to be owned by the uptimed user at emerge-time through the creation of hard links within the /var/spool/uptimed directory. This occurs due to an unsafe chown -R call that follows both symlinks and hardlinks by default (Gentoo Bug).

The vulnerability allows the uptimed user to achieve root privileges when the uptimed package is emerged. This represents a significant privilege escalation vulnerability that could compromise system security (GENTOO GLSA).

Users should upgrade to uptimed version 0.4.6-r1 or later. The fix involves removing the problematic ownership changes in the pkg_postinst phase. The upgrade can be performed using the command: emerge --sync && emerge --ask --oneshot --verbose ">=app-misc/uptimed-0.4.6-r1" (GENTOO GLSA).