CVE-2021-31998 inn: %post calls user owned file allowing local privilege escalation to root
Local attackers can escalate privileges to root due to incorrect default permissions in the inn package's post-installation script.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-31998?
CVE-2021-31998 is a medium-severity vulnerability in SUSE Linux Enterprise Server 11-SP3, published on 10 Jun 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root. This issue affects: SUSE Linux Enterprise Server 11-SP3 inn version inn-2.4.2-170.21.3.1 and prior versions. openSUSE Backports SLE-15-SP2 inn versions prior to 2.6.2. openSUSE Leap 15.2 inn versions prior to 2.6.2.
Weakness: CWE-276
Which versions are affected by CVE-2021-31998?
It affects 1 product.
Linux distribution packages (4)
inn SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 2.4.2-170.21.3.6.1 |
inn SUSE:Linux Enterprise Server 11 SP4-LTSS | All versions | 2.4.2-170.21.3.6.1 |
inn SUSE:Package Hub 15 SP2 | All versions | 2.6.2-bp152.2.8.1 |
inn openSUSE:Leap 15.2 | All versions | 2.6.2-lp152.2.6.1 |
Products include Opensuse Inn.
How do I fix CVE-2021-31998?
Apply the vendor's patch.
Is CVE-2021-31998 being exploited?
There is no known exploitation of CVE-2021-31998 in the wild and no public exploit code.
Sources
Also known as GHSA-rqpg-j7j6-g58g, SUSE-SU-2021:14750-1, UBUNTU-CVE-2021-31998, openSUSE-SU-2021:0830-1, openSUSE-SU-2021:0845-1.