Cloudanix VulnDB

CVE-2020-10759

Medium · 6.0

CVSS

6.0

EPSS

0.5%

Published

Sep 15, 2020

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A problem in firmware update software could let someone with deep system access slip in bad firmware without proper approval, though this is unlikely to work in typical enterprise Linux setups.

Exploit Available
Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Theoretical
Impact
Data Tampering
Component
Application
Class
Cryptographic Weakness
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A cryptographic weakness in PGP signature verification within fwupd permits bypassing checks to install unsigned or malicious firmware packages on affected systems.

Why it matters to the business

Attackers with local high-privileged access could install tampered firmware that compromises system confidentiality and integrity, though the flaw is not practical in standard Red Hat Enterprise Linux deployments where the Linux Vendor Firmware Service remains disabled.

How an attack unfolds

An attacker with local administrative access prepares a crafted firmware image lacking a valid PGP signature, then leverages the verification bypass in fwupd to force installation of the unsigned firmware, potentially leading to persistent system compromise.

How to fix it

Disable or avoid enabling the Linux Vendor Firmware Service in fwupd configurations on Red Hat Enterprise Linux systems; monitor upstream for any future patches addressing the signature verification logic; restrict local administrative access to firmware update tools.

How to confirm the fix worked

Review fwupd configuration files and runtime settings to confirm LVFS is not enabled; test firmware update flows with intentionally unsigned packages to verify rejection behavior; audit system logs for any firmware installations that bypassed signature checks.

Typical attack path

  1. Obtain local high-privileged access on a target system
  2. Craft or obtain unsigned malicious firmware
  3. Invoke fwupd to process the unsigned package
  4. Bypass PGP signature validation and install the firmware

How to detect it

Examine fwupd and system update logs for entries showing firmware installations that lack signature validation success; search process execution records for fwupd invocations with unsigned package arguments; review audit trails for unexpected firmware files installed outside normal vendor channels.

What your security team should do

  • Confirm LVFS remains disabled across all Red Hat Enterprise Linux deployments
  • Limit local privileged access to firmware management utilities
  • Monitor EPSS trends and exploit availability for any changes indicating increased risk
  • Establish logging for all fwupd operations to detect anomalous update attempts

The record

A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service (LVFS) is either not implemented or enabled in versions of fwupd shipped with Red Hat Enterprise Linux 7 and 8. The highest threat from this vulnerability is to confidentiality and integrity.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 appstream-data 0 8-20200724.el8
AlmaLinux:8 libxmlb 0 0.1.15-1.el8
Debian:11 fwupd 0 1.3.10-1
Debian:11 libjcat 0 0.1.3-1
Debian:12 fwupd 0 1.3.10-1
Debian:12 libjcat 0 0.1.3-1
Debian:13 fwupd 0 1.3.10-1
Debian:13 libjcat 0 0.1.3-1
Debian:9 fwupd 0 0.7.4-2+deb9u1
Mageia:7 fwupd 0 1.2.8-1.1.mga7
Red Hat:enterprise_linux:8::appstream appstream-data 0 0:8-20200724.el8
Red Hat:enterprise_linux:8::appstream gnome-software 0 0:3.36.1-4.el8
Red Hat:enterprise_linux:8::appstream gnome-software-debuginfo 0 0:3.36.1-4.el8
Red Hat:enterprise_linux:8::appstream gnome-software-debugsource 0 0:3.36.1-4.el8
Red Hat:enterprise_linux:8::baseos fwupd 0 0:1.4.2-4.el8
Red Hat:enterprise_linux:8::baseos fwupd-debuginfo 0 0:1.4.2-4.el8
Red Hat:enterprise_linux:8::baseos fwupd-debugsource 0 0:1.4.2-4.el8
Red Hat:enterprise_linux:8::baseos libxmlb 0 0:0.1.15-1.el8
Red Hat:enterprise_linux:8::baseos libxmlb-debuginfo 0 0:0.1.15-1.el8
Red Hat:enterprise_linux:8::baseos libxmlb-debugsource 0 0:0.1.15-1.el8
Red Hat:enterprise_linux:8::baseos libxmlb-tests-debuginfo 0 0:0.1.15-1.el8
Rocky Linux:8 appstream-data 0 0:8-20200724.el8
Rocky Linux:8 libxmlb 0 0:0.1.15-1.el8
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1 fwupd 0 1.0.9-6.3.1
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2 fwupd 0 1.2.14-5.8.2
Ubuntu:16.04:LTS fwupd 0 0.8.3-0ubuntu5.1
Ubuntu:18.04:LTS fwupd 0 1.2.10-1ubuntu2~ubuntu18.04.5
Ubuntu:20.04:LTS fwupd 0 1.3.9-4ubuntu0.1
openSUSE:Leap 15.1 fwupd 0 1.0.9-lp151.2.3.1
openSUSE:Leap 15.2 fwupd 0 1.2.14-lp152.3.9.1
openSUSE:Tumbleweed fwupd 0 1.5.8-1.5

Related vulnerabilities