Description
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | trousers | 0.3.15-0.1 | — |
| Debian 13 | trousers | 0.3.15-0.1 | — |
| Debian 12 | trousers | 0.3.15-0.1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | trousers | No fix yet | — |
| Ubuntu 18.04 LTS | trousers | No fix yet | — |
| Ubuntu 16.04 LTS | trousers | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | trousers +2 | 0.3.15-1.el8 | RHSA-2021:1627 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | trousers +2 | 0.3.15-1.el8 | ALSA-2021:1627 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | trousers | 0.3.15-1.el8 | RLSA-2021:1627 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | trousers | 0.3.14-150000.3.3.1 | SUSE-SU-2022:2798-1 |
| SLES 12 SP2 | trousers | 0.3.13-3.3.1 | SUSE-SU-2022:2800-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 | trousers | 0.3.14-150000.3.3.1 | SUSE-SU-2022:2798-1 |
| SLE HPC 15 | trousers | 0.3.14-150000.3.3.1 | SUSE-SU-2022:2798-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | trousers | 0.3.14-7 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | trousers +2 | 0.3.15-1.el8 | ELSA-2021-1627 |
Advisories 6
- ALSA-2021:1627 Moderate: trousers security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2021:1627 Red Hat Security Advisory: trousers security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RLSA-2021:1627 Moderate: trousers security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2022:2798-1 Security update for trousers SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2800-1 Security update for trousers SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2021-1627 Moderate: trousers security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 25, 2021
References
- https://sourceforge.net/p/trousers/mailman/message/37015817/
- https://bugzilla.suse.com/show_bug.cgi?id=1164472
- https://seclists.org/oss-sec/2020/q2/att-135/tcsd_fixes.patch
- [oss-security] 20200814 Re: [TrouSerS-tech] Multiple Security Issues in the TrouSerS tpm1.2 tscd Daemon mailing-list
- FEDORA-2020-ab3dace708 vendor-advisory