CVE-2020-8933

CVE-2020-8933 is a privilege escalation vulnerability in Google Cloud Platform's guest-oslogin, affecting versions between 20190304 and 20200507, as well as OpenSUSE guest-oslogin and leap. An attacker with only the "roles/compute.osLogin" role can leverage membership in the "lxd" group to attach host devices and filesystems. This allows modification of the host OS filesystem, specifically /etc/sudoers, to gain root privileges. Rated with a CVSS score of 7.8 (HIGH), this vulnerability has a low attack complexity and requires local access, but can lead to complete compromise of confidentiality, integrity, and availability. While the EPSS score is low, indicating a low probability of exploitation in the wild, the FAUCET Risk Score is 57/100. There is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a lack of widespread attention.