CVE-2022-21946 suddoers configuration for cscreen not restrictive enough
Local users can escalate privileges to tty and dialout groups and manipulate running cscreen sessions due to restrictive sudoers configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21946?
CVE-2022-21946 is a medium-severity vulnerability in openSUSE Factory, published on 16 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.
Weakness: CWE-732
Which versions are affected by CVE-2022-21946?
It affects 1 product.
Products include Opensuse Cscreen.
How do I fix CVE-2022-21946?
Apply the vendor's patch.
Is CVE-2022-21946 being exploited?
There is no known exploitation of CVE-2022-21946 in the wild and no public exploit code.
Other vulnerabilities in openSUSE Factory
Sources
Also known as GHSA-wj8w-cmvq-mfv8.