Vulnerability · Published Aug 24, 2020 · Assigned by mitre
CVE-2020-24612
Medium 6.7
In plain English
A medium-severity security flaw in the refpolicy package (Ubuntu). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok option (the default when configured by the authselect tool), and that file cannot be read, the second factor is disabled. An attacker with only the knowledge of the password can then log in, bypassing 2FA.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | refpolicy | no fix listed | UBUNTU-CVE-2020-24612 |
| Ubuntu:24.04:LTS | refpolicy | no fix listed | UBUNTU-CVE-2020-24612 |
| Ubuntu:25.10 | refpolicy | no fix listed | UBUNTU-CVE-2020-24612 |
| Ubuntu:26.04:LTS | refpolicy | no fix listed | UBUNTU-CVE-2020-24612 |
| Ubuntu:26.10 | refpolicy | no fix listed | UBUNTU-CVE-2020-24612 |