CVE-2020-21583
util-linux: arbitrary commands execution via the path parameter
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · August 22, 2023
Updated · November 21, 2025
Description
A vulnerability was found in hwclock in util-linux, which allowed non-root users to access the hardware clock. This flaw allows an attacker to execute arbitrary code via the path parameter when setting the date.
Statement
This presents an issue only in scenarios where the administrator has configured hwclock to be setuid root. However, it's important to note that this is a non-default and unlikely configuration.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.4CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')