CVE Database›CVE-2020-21583

CVE-2020-21583

util-linux: arbitrary commands execution via the path parameter

Loading…

Severity

Moderate

Red Hat Product Security

6.4

CVSS 3.1

Review impact separately from score.

Published · August 22, 2023

Updated · November 21, 2025

Description

A vulnerability was found in hwclock in util-linux, which allowed non-root users to access the hardware clock. This flaw allows an attacker to execute arbitrary code via the path parameter when setting the date.

Statement

This presents an issue only in scenarios where the administrator has configured hwclock to be setuid root. However, it's important to note that this is a non-default and unlikely configuration.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 6.4
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')