CVE-2020-8017: 
Linux openSUSE vulnerability analysis and mitigation

CVE-2020-8017 affects texlive-filesystem package, specifically related to a race condition in a cron job. The vulnerability was discovered in December 2019 and disclosed in April 2020. The issue affects SUSE Linux Enterprise and openSUSE Leap distributions (SUSE Security).

The vulnerability stems from a race condition in the texlive-filesystem cron job that allows members of the mktex group to trick root into deleting arbitrary files. The issue occurs because the cron job runs as root while operating on files owned by unprivileged users, creating a potential privilege escalation vector (SUSE Bug).

A successful exploitation of this vulnerability could allow an attacker who has compromised a member of the mktex group to cause arbitrary files to be deleted on the system, potentially leading to privilege escalation (SUSE Bug).

The fix involves changing the ownership of directories to nobody:mktex and modifying the deletion logic to run using setpriv under nobody:mktex privileges. The use of safe-rm and safe-rmdir utilities was removed as part of the fix (SUSE Bug).