CVE-2020-8032: 
NixOS vulnerability analysis and mitigation

A local privilege escalation vulnerability (CVE-2020-8032) was discovered in the packaging of cyrus-sasl in openSUSE Factory. The vulnerability allows local attackers to escalate privileges to root through insecure temporary file handling in the package's pre-installation script (SUSE Bugzilla).

The vulnerability exists in the cyrus-sasl.spec file's %pre section where an insecure temporary file (/tmp/saslpw.awk) is created and used during password file conversion from Berkeley to GDBM format. Due to a race condition between file creation and usage, an attacker can modify the temporary file's contents after it's written but before it's executed by gawk, allowing arbitrary command execution with root privileges (SUSE Bugzilla).

If successfully exploited, this vulnerability allows local users to escalate their privileges to root, potentially gaining complete control over the affected system. While the race condition is described as hard to win, an optimized exploit could make the attack more reliable (SUSE Bugzilla).

The vulnerability requires local access to the system and can only be triggered once during package installation. The exploit involves creating and monitoring /tmp/saslpw.awk file, then modifying it during a narrow time window between file creation and execution. While the race condition is difficult to exploit, it remains a significant security risk (SUSE Bugzilla).

The recommended fix involves using a secure way to create temporary files or avoiding writing them to locations that users can influence. The vulnerability was addressed through package updates in openSUSE Factory (SUSE Bugzilla).