Every CVE Search/ Get API key

CVE-2020-24331

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root...

7.8 HighFix available

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.49%Down 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).

Record
CVE-2020-24331
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-269
Updated
2026-11-02
CVE List No score

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).

Record
CVE-2020-24331
Updated
2026-11-02
EUVDEUVD-2020-17065 No score

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).

Record
EUVD-2020-17065
Updated
2026-11-03
GitHub AdvisoriesGHSA-92g6-rx66-6q4j 7.8

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root...

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).

Record
GHSA-92g6-rx66-6q4j
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-269, CWE-732
Updated
2026-11-02
OSVAZL-6926 7.8

CVE-2020-24331 affecting package trousers for versions less than 0.3.14-7

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).

Record
AZL-6926
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.8

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).

Record
CVE-2020-24331
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2020-24331 7.8

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).

Record
DEBIAN-CVE-2020-24331
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:1627 7.8

Red Hat Security Advisory: trousers security, bug fix, and enhancement update

Record
RHSA-2021:1627
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:1627 7.8

Moderate: trousers security, bug fix, and enhancement update

TrouSerS is an implementation of the Trusted Computing Group's Software Stack (TSS) specification. TrouSerS enables the user to write applications that make use of the Trusted Platform Module (TPM) hardware.

The following packages have been upgraded to a later upstream version: trousers (0.3.15). (BZ#1725782)

Security Fix(es):

  • trousers: tss user still has read and write access to the /etc/tcsd.conf file if tcsd is started as root (CVE-2020-24331)

  • trousers: tss user can be used to create or corrupt existing files, this could lead to DoS (CVE-2020-24332)

  • trousers: fails to drop the root gid privilege when no longer needed (CVE-2020-24330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

Record
RLSA-2021:1627
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-24331 7.8

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).

Record
UBUNTU-CVE-2020-24331
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2021:1627 No score

Moderate: trousers security, bug fix, and enhancement update

TrouSerS is an implementation of the Trusted Computing Group's Software Stack (TSS) specification. TrouSerS enables the user to write applications that make use of the Trusted Platform Module (TPM) hardware.

The following packages have been upgraded to a later upstream version: trousers (0.3.15). (BZ#1725782)

Security Fix(es):

  • trousers: tss user still has read and write access to the /etc/tcsd.conf file if tcsd is started as root (CVE-2020-24331)

  • trousers: tss user can be used to create or corrupt existing files, this could lead to DoS (CVE-2020-24332)

  • trousers: fails to drop the root gid privilege when no longer needed (CVE-2020-24330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2021:1627
Updated
2026-11-02
OSVMGASA-2021-0297 No score

Updated trousers packages fix security vulnerabilities

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed (CVE-2020-24330).

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon) (CVE-2020-24331).

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack (CVE-2020-24332).

Record
MGASA-2021-0297
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
trousers
AlmaLinux:8
From an advisory covering 3 CVEs
 before 0.3.15-1.el8
0.3.15-1.el8
trousers-devel
AlmaLinux:8
From an advisory covering 3 CVEs
 before 0.3.15-1.el8
0.3.15-1.el8
trousers-lib
AlmaLinux:8
From an advisory covering 3 CVEs
 before 0.3.15-1.el8
0.3.15-1.el8
trousers
Azure Linux:2
 before 0.3.14-7
0.3.14-7
trousers
Debian:12
 before 0.3.15-0.1
0.3.15-0.1
trousers
Debian:13
 before 0.3.15-0.1
0.3.15-0.1
trousers
Debian:14
 before 0.3.15-0.1
0.3.15-0.1
trousers
Mageia:7
From an advisory covering 3 CVEs
 before 0.3.14-4.2.mga7
0.3.14-4.2.mga7
trousers
Red Hat:enterprise_linux:8::baseos
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
Show 11 moreShow less
Affected packages
PackageAffectedFixed
trousers-debugsource
Red Hat:enterprise_linux:8::baseos
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers-lib
Red Hat:enterprise_linux:8::baseos
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers-lib-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers-debugsource
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers-devel
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers-lib-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:0.3.15-1.el8
0:0.3.15-1.el8
trousers
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.3.13-4
 None known
trousers
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.3.14+fixed1-10.3.14+fixed1-1build1
 None known
trousers
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.3.14+fixed1-1build1
 None known

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-24331 is a high vulnerability (CVSS 7.8) in Trousers Project Trousers, published August 13, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in trousers 0.3.14-7.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open