// For flags

CVE-2020-2016

PAN-OS: Temporary file race condition vulnerability in PAN-OS leads to local privilege escalation

Severity Score

7.0
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account. This allows an attacker who has escaped the restricted shell as a low privilege administrator, possibly by exploiting another vulnerability, to escalate privileges to become root user. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; All versions of PAN-OS 8.0.

Una condición de carrera debido a la creación no segura de un archivo en una vulnerabilidad de directorio temporal en PAN-OS permite la escalada de privilegios raíz desde una cuenta de usuario de Linux limitada. Esto permite que un atacante que haya escapado del shell restringido como administrador de bajos privilegios, posiblemente explotando otra vulnerabilidad, escale privilegios para convertirse en usuario root. Este problema afecta: PAN-OS 7.1 versiones anteriores a la versión 7.1.26; PAN-OS 8.1 versiones anteriores a la versión 8.1.13; PAN-OS 9.0 versiones anteriores a la versión 9.0.6; Todas las versiones de PAN-OS 8.0.

*Credits: Palo Alto Networks thanks the UK's National Cyber Security Centre (NCSC) for discovering and reporting this issue., Palo Alto Networks thanks the NCC Group for finding this issue independently during a contracted PAN-OS security assessment.
CVSS Scores
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-12-04 CVE Reserved
  • 2020-05-13 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
  • CWE-377: Insecure Temporary File
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Paloaltonetworks
Search vendor "Paloaltonetworks"
Pan-os
Search vendor "Paloaltonetworks" for product "Pan-os"
>= 7.1.0 < 7.1.26
Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 7.1.0 < 7.1.26"
-
Affected
Paloaltonetworks
Search vendor "Paloaltonetworks"
Pan-os
Search vendor "Paloaltonetworks" for product "Pan-os"
>= 8.0.0 <= 8.0.20
Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 8.0.0 <= 8.0.20"
-
Affected
Paloaltonetworks
Search vendor "Paloaltonetworks"
Pan-os
Search vendor "Paloaltonetworks" for product "Pan-os"
>= 8.1.0 < 8.1.13
Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 8.1.0 < 8.1.13"
-
Affected
Paloaltonetworks
Search vendor "Paloaltonetworks"
Pan-os
Search vendor "Paloaltonetworks" for product "Pan-os"
>= 9.0.0 < 9.0.6
Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 9.0.0 < 9.0.6"
-
Affected