Description
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | trousers | 0.3.15-0.1 | — |
| Debian 13 | trousers | 0.3.15-0.1 | — |
| Debian 12 | trousers | 0.3.15-0.1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | trousers | No fix yet | — |
| Ubuntu 18.04 LTS | trousers | No fix yet | — |
| Ubuntu 16.04 LTS | trousers | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | trousers +2 | 0.3.15-1.el8 | RHSA-2021:1627 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | trousers +2 | 0.3.15-1.el8 | ALSA-2021:1627 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | trousers | 0.3.15-1.el8 | RLSA-2021:1627 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | trousers | 0.3.15-1.7 | openSUSE-SU-2024:11476-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | trousers | 0.3.14-7 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | trousers +2 | 0.3.15-1.el8 | ELSA-2021-1627 |
Advisories 5
- ALSA-2021:1627 Moderate: trousers security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2021:1627 Red Hat Security Advisory: trousers security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RLSA-2021:1627 Moderate: trousers security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2024:11476-1 libtspi1-0.3.15-1.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2021-1627 Moderate: trousers security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 25, 2021
References
- https://sourceforge.net/p/trousers/mailman/message/37015817/
- https://bugzilla.suse.com/show_bug.cgi?id=1164472
- https://seclists.org/oss-sec/2020/q2/att-135/tcsd_fixes.patch
- [oss-security] 20200814 Re: [TrouSerS-tech] Multiple Security Issues in the TrouSerS tpm1.2 tscd Daemon mailing-list
- FEDORA-2020-ab3dace708 vendor-advisory