CVE-2020-24332
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root...
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
- Record
CVE-2020-24332- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.9 Medium
AV:L/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
- Record
CVE-2020-24332- Updated
- 2026-11-02
EUVDEUVD-2020-17066 No score
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
- Record
EUVD-2020-17066- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-46r6-q3g6-pccf
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root...
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
- Record
GHSA-46r6-q3g6-pccf- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVAZL-6927
CVE-2020-24332 affecting package trousers for versions less than 0.3.14-7
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
- Record
AZL-6927- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
- Record
CVE-2020-24332- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2020-24332
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
- Record
DEBIAN-CVE-2020-24332- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2021:1627
Red Hat Security Advisory: trousers security, bug fix, and enhancement update
- Record
RHSA-2021:1627- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2021:1627
Moderate: trousers security, bug fix, and enhancement update
TrouSerS is an implementation of the Trusted Computing Group's Software Stack (TSS) specification. TrouSerS enables the user to write applications that make use of the Trusted Platform Module (TPM) hardware.
The following packages have been upgraded to a later upstream version: trousers (0.3.15). (BZ#1725782)
Security Fix(es):
-
trousers: tss user still has read and write access to the /etc/tcsd.conf file if tcsd is started as root (CVE-2020-24331)
-
trousers: tss user can be used to create or corrupt existing files, this could lead to DoS (CVE-2020-24332)
-
trousers: fails to drop the root gid privilege when no longer needed (CVE-2020-24330)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.
- Record
RLSA-2021:1627- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-24332
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
- Record
UBUNTU-CVE-2020-24332- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2021:1627 No score
Moderate: trousers security, bug fix, and enhancement update
TrouSerS is an implementation of the Trusted Computing Group's Software Stack (TSS) specification. TrouSerS enables the user to write applications that make use of the Trusted Platform Module (TPM) hardware.
The following packages have been upgraded to a later upstream version: trousers (0.3.15). (BZ#1725782)
Security Fix(es):
-
trousers: tss user still has read and write access to the /etc/tcsd.conf file if tcsd is started as root (CVE-2020-24331)
-
trousers: tss user can be used to create or corrupt existing files, this could lead to DoS (CVE-2020-24332)
-
trousers: fails to drop the root gid privilege when no longer needed (CVE-2020-24330)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2021:1627- Updated
- 2026-11-02
OSVMGASA-2021-0297 No score
Updated trousers packages fix security vulnerabilities
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed (CVE-2020-24330).
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon) (CVE-2020-24331).
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack (CVE-2020-24332).
- Record
MGASA-2021-0297- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11476-1 No score
libtspi1-0.3.15-1.7 on GA media
These are all security issues fixed in the libtspi1-0.3.15-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11476-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
trousersAlmaLinux:8 From an advisory covering 3 CVEs |
before 0.3.15-1.el8 | 0.3.15-1.el8 |
trousers-develAlmaLinux:8 From an advisory covering 3 CVEs |
before 0.3.15-1.el8 | 0.3.15-1.el8 |
trousers-libAlmaLinux:8 From an advisory covering 3 CVEs |
before 0.3.15-1.el8 | 0.3.15-1.el8 |
trousersAzure Linux:2 |
before 0.3.14-7 | 0.3.14-7 |
trousersDebian:12 |
before 0.3.15-0.1 | 0.3.15-0.1 |
trousersDebian:13 |
before 0.3.15-0.1 | 0.3.15-0.1 |
trousersDebian:14 |
before 0.3.15-0.1 | 0.3.15-0.1 |
trousersMageia:7 From an advisory covering 3 CVEs |
before 0.3.14-4.2.mga7 | 0.3.14-4.2.mga7 |
trousersRed Hat:enterprise_linux:8::baseos From an advisory covering 3 CVEs |
before 0:0.3.15-1.el8 | 0:0.3.15-1.el8 |
trousers-debuginfoRed Hat:enterprise_linux:8::baseos From an advisory covering 3 CVEs |
before 0:0.3.15-1.el8 | 0:0.3.15-1.el8 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
trousers-debugsourceRed Hat:enterprise_linux:8::baseos From an advisory covering 3 CVEs |
before 0:0.3.15-1.el8 | 0:0.3.15-1.el8 |
trousers-libRed Hat:enterprise_linux:8::baseos From an advisory covering 3 CVEs |
before 0:0.3.15-1.el8 | 0:0.3.15-1.el8 |
trousers-lib-debuginfoRed Hat:enterprise_linux:8::baseos From an advisory covering 3 CVEs |
before 0:0.3.15-1.el8 | 0:0.3.15-1.el8 |
trousers-debuginfoRed Hat:enterprise_linux:8::crb From an advisory covering 3 CVEs |
before 0:0.3.15-1.el8 | 0:0.3.15-1.el8 |
trousers-debugsourceRed Hat:enterprise_linux:8::crb From an advisory covering 3 CVEs |
before 0:0.3.15-1.el8 | 0:0.3.15-1.el8 |
trousers-develRed Hat:enterprise_linux:8::crb From an advisory covering 3 CVEs |
before 0:0.3.15-1.el8 | 0:0.3.15-1.el8 |
trousers-lib-debuginfoRed Hat:enterprise_linux:8::crb From an advisory covering 3 CVEs |
before 0:0.3.15-1.el8 | 0:0.3.15-1.el8 |
trousersRocky Linux:8 From an advisory covering 3 CVEs |
before 0:0.3.15-1.el8 | 0:0.3.15-1.el8 |
trousersUbuntu:16.04:LTS |
All versions, plus listed versions 0.3.13-4 |
None known |
trousersUbuntu:18.04:LTS |
All versions, plus listed versions 0.3.14+fixed1-10.3.14+fixed1-1build1 |
None known |
trousersUbuntu:20.04:LTS |
All versions, plus listed versions 0.3.14+fixed1-1build1 |
None known |
trousersopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 0.3.15-1.7 | 0.3.15-1.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-24332 is a medium vulnerability (CVSS 5.5) in Trustedcomputinggroup Trousers, published August 13, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in trousers 0.3.14-7.
References
sourceforge.net/p/trousers/mailman/message/37015817
bugzilla.suse.com/show_bug.cgi?id=1164472
seclists.org/oss-sec/2020/q2/att-135/tcsd_fixes.patch
openwall.com/lists/oss-security/2020/08/14/1
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SSDL7COIFCZQMUBNAASNMKMX7W5JUHRD
nvd.nist.gov/vuln/detail/CVE-2020-24332
Show 29 moreShow less
github.com/advisories/GHSA-46r6-q3g6-pccf
errata.almalinux.org/8/ALSA-2021-1627.html
vulners.com/cve/CVE-2020-24330
security-tracker.debian.org/tracker/CVE-2020-24332
advisories.mageia.org/MGASA-2021-0297.html
bugs.mageia.org/show_bug.cgi?id=26658
access.redhat.com/errata/RHSA-2021:1627
bugzilla.redhat.com/show_bug.cgi?id=1870052
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1627.json
cve.org/CVERecord?id=CVE-2020-24330
errata.rockylinux.org/RLSA-2021:1627
ubuntu.com/security/CVE-2020-24332
suse.com/security/cve/CVE-2019-18898