CVE-2020-8933
Priviged Escalation in Google Cloud Platform's Guest-OSLogin
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using the membership to the "lxd" group, an attacker can attach host devices and filesystems. Within an lxc container, it is possible to attach the host OS filesystem and modify /etc/sudoers to then gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "lxd" user from the OS Login entry.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Priviged Escalation in Google Cloud Platform's Guest-OSLogin
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using the membership to the "lxd" group, an attacker can attach host devices and filesystems. Within an lxc container, it is possible to attach the host OS filesystem and modify /etc/sudoers to then gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "lxd" user from the OS Login entry.
- Record
CVE-2020-8933- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-276
- Updated
- 2026-11-02
EUVDEUVD-2020-29764
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using the membership to the "lxd" group, an attacker can attach host devices and filesystems. Within an lxc container, it is possible to attach the host OS filesystem and modify /etc/sudoers to then gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "lxd" user from the OS Login entry.
- Record
EUVD-2020-29764- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-29jr-2926-3w9p
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507...
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using the membership to the "lxd" group, an attacker can attach host devices and filesystems. Within an lxc container, it is possible to attach the host OS filesystem and modify /etc/sudoers to then gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "lxd" user from the OS Login entry.
- Record
GHSA-29jr-2926-3w9p- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
NVD
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using the membership to the "lxd" group, an attacker can attach host devices and filesystems. Within an lxc container, it is possible to attach the host OS filesystem and modify /etc/sudoers to then gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "lxd" user from the OS Login entry.
- Record
CVE-2020-8933- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-276
- Updated
- 2026-11-02
OSV
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using the membership to the "lxd" group, an attacker can attach host devices and filesystems. Within an lxc container, it is possible to attach the host OS filesystem and modify /etc/sudoers to then gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "lxd" user from the OS Login entry.
- Record
CVE-2020-8933- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-8933
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using the membership to the "lxd" group, an attacker can attach host devices and filesystems. Within an lxc container, it is possible to attach the host OS filesystem and modify /etc/sudoers to then gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "lxd" user from the OS Login entry.
- Record
UBUNTU-CVE-2020-8933- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2020:0996-1 No score
Security update for google-compute-engine
This update for google-compute-engine fixes the following issues:
-
Don't enable and start google-network-daemon.service when it's already installed (bsc#1169978)
- Do not add the created user to the adm (CVE-2020-8903), docker (CVE-2020-8907), or lxd (CVE-2020-8933) groups if they exist (bsc#1173258) This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0996-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1014-1 No score
Security update for google-compute-engine
This update for google-compute-engine fixes the following issues:
-
Don't enable and start google-network-daemon.service when it's already installed (bsc#1169978)
- Do not add the created user to the adm (CVE-2020-8903), docker (CVE-2020-8907), or lxd (CVE-2020-8933) groups if they exist (bsc#1173258)
- Record
openSUSE-SU-2020:1014-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1934-1 No score
Security update for google-compute-engine
This update for google-compute-engine fixes the following issues:
-
Don't enable and start google-network-daemon.service when it's already installed (bsc#1169978)
- Do not add the created user to the adm (CVE-2020-8903), docker (CVE-2020-8907), or lxd (CVE-2020-8933) groups if they exist (bsc#1173258)
- Record
SUSE-SU-2020:1934-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2200-1 No score
Security update for google-compute-engine
This update for google-compute-engine fixes the following issues:
- Do not add the created user to the adm (CVE-2020-8903), docker (CVE-2020-8907), or lxd (CVE-2020-8933) groups if they exist (bsc#1173258).
- Don't enable and start google-network-daemon.service when it's already installed (bsc#1169978).
- Record
SUSE-SU-2020:2200-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
google-compute-engineSUSE:Linux Enterprise Module for Public Cloud 15 SP1 From an advisory covering 3 CVEs |
before 20190801-4.38.1 | 20190801-4.38.1 |
google-compute-engineSUSE:Linux Enterprise Module for Public Cloud 15 SP2 From an advisory covering 3 CVEs |
before 20190801-4.38.1 | 20190801-4.38.1 |
google-compute-engineSUSE:Linux Enterprise Module for Public Cloud 12 From an advisory covering 3 CVEs |
before 20190801-54.1 | 20190801-54.1 |
gce-compute-image-packagesUbuntu:14.04:LTS |
All versions, plus listed versions 20160930-0ubuntu3~14.04.020160930-0ubuntu3~14.04.120160930-0ubuntu3~14.04.220160930-0ubuntu6~14.04.020170426-0ubuntu2~14.04.0 Show 12 moreShow less20170523-0ubuntu1~14.04.020170622-0ubuntu1~14.04.020170718-0ubuntu1~14.04.020171019+dfsg1-0ubuntu1~14.04.020171025+dfsg1-0ubuntu1~14.04.020171129+dfsg1-0ubuntu1~14.04.020180129+dfsg1-0ubuntu1~14.04.020180510+dfsg1-0ubuntu3~14.04.320180905+dfsg1-0ubuntu1~14.04.020180905+dfsg1-0ubuntu1~14.04.120190124+dfsg1-0ubuntu1~14.04.020190315-0ubuntu1~14.04.0 |
None known |
gce-compute-image-packagesUbuntu:16.04:LTS |
before 20190801-0ubuntu1~16.04.1, plus listed versions 20160930-0ubuntu3~16.04.020160930-0ubuntu5~16.04.020160930-0ubuntu6~16.04.020170426-0ubuntu2~16.04.020170523-0ubuntu1~16.04.0 Show 13 moreShow less20170622-0ubuntu1~16.04.020170718-0ubuntu1~16.04.020171019+dfsg1-0ubuntu1~16.04.020171025+dfsg1-0ubuntu1~16.04.020171129+dfsg1-0ubuntu1~16.04.020180129+dfsg1-0ubuntu1~16.04.020180510+dfsg1-0ubuntu3~16.04.020180510+dfsg1-0ubuntu3~16.04.120180905+dfsg1-0ubuntu1~16.04.020180905+dfsg1-0ubuntu1~16.04.120190124+dfsg1-0ubuntu1~16.04.020190522-0ubuntu1~16.04.020190801-0ubuntu1~16.04.0 |
20190801-0ubuntu1~16.04.1 |
gce-compute-image-packagesUbuntu:18.04:LTS |
before 20190801-0ubuntu1~18.04.1, plus listed versions 20171006+dfsg1-0ubuntu120171019+dfsg1-0ubuntu120171025+dfsg1-0ubuntu120171129+dfsg1-0ubuntu120180129+dfsg1-0ubuntu1 Show 8 moreShow less20180129+dfsg1-0ubuntu220180129+dfsg1-0ubuntu320180510+dfsg1-0ubuntu4~18.04.020180510+dfsg1-0ubuntu4~18.04.120180905+dfsg1-0ubuntu1~18.04.020190124+dfsg1-0ubuntu1~18.04.020190522-0ubuntu1~18.04.020190801-0ubuntu1~18.04.0 |
20190801-0ubuntu1~18.04.1 |
gce-compute-image-packagesUbuntu:20.04:LTS |
before 20190801-0ubuntu4.1, plus listed versions 20190801-0ubuntu120190801-0ubuntu220190801-0ubuntu320190801-0ubuntu4 |
20190801-0ubuntu4.1 |
google-compute-engineopenSUSE:Leap 15.1 From an advisory covering 3 CVEs |
before 20190801-lp151.2.25.1 | 20190801-lp151.2.25.1 |
google-compute-engineopenSUSE:Leap 15.2 From an advisory covering 3 CVEs |
before 20190801-lp152.5.4.1 | 20190801-lp152.5.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8933 is a critical vulnerability (CVSS 9.3) in Google Guest-oslogin, published June 22, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in gce-compute-image-packages 20190801-0ubuntu1~16.04.1.
References
github.com/GoogleCloudPlatform/guest-oslogin/pull/29
gitlab.com/gitlab-com/gl-security/gl-redteam/red-team-tech-notes/-/tree/master/oslogin-privesc-june-2020
cloud.google.com/support/bulletins
lists.opensuse.org/opensuse-security-announce/2020-07/msg00037.html
nvd.nist.gov/vuln/detail/CVE-2020-8933
Show 12 moreShow less
suse.com/support/update/announcement/2020/suse-su-20201934-1
bugzilla.suse.com/1169978
ubuntu.com/security/CVE-2020-8933
cve.org/CVERecord?id=CVE-2020-8933