CVE-2020-21583

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-08-22 · updated 2026-06-17
Weakness: CWE-78

Description

An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.

Affected products

util-linux: before 2.27 — fixed in 2.27

How to fix

Upgrade to a fixed version: util-linux 2.27. Check the vendor advisory for mitigations.

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786804
https://packetstormsecurity.com/files/132061/hwclock-Privilege-Escalation.html
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786804
https://packetstormsecurity.com/files/132061/hwclock-Privilege-Escalation.html
https://security.netapp.com/advisory/ntap-20241220-0006/

Get alerted when CVE-2020-21583 or the next vulnerability affects your stack