CVE-2022-31252 permissions: chkstat does not check for group-writable parent directories or target files in safeOpen()

2022-09-0200:00:00

CWE-863

suse

www.cve.org

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the path to a privileged binary to influence path resolution. This issue affects: SUSE Linux Enterprise Server 12-SP5 permissions versions prior to 20170707. openSUSE Leap 15.3 permissions versions prior to 20200127. openSUSE Leap 15.4 permissions versions prior to 20201225. openSUSE Leap Micro 5.2 permissions versions prior to 20181225.

CNA Affected

[
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Server 12-SP5",
    "versions": [
      {
        "version": "permissions",
        "status": "affected",
        "lessThan": "20170707",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "openSUSE",
    "product": "openSUSE Leap 15.3",
    "versions": [
      {
        "version": "permissions",
        "status": "affected",
        "lessThan": "20200127",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "openSUSE",
    "product": "openSUSE Leap 15.4",
    "versions": [
      {
        "version": "permissions",
        "status": "affected",
        "lessThan": "20201225",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "openSUSE",
    "product": "openSUSE Leap Micro 5.2",
    "versions": [
      {
        "version": "permissions",
        "status": "affected",
        "lessThan": "20181225",
        "versionType": "custom"
      }
    ]
  }
]