CVE-2022-31251 slurm: %post for slurm-testsuite operates as root in user owned directory

Medium 6.5 Published 7 Sep 2022 Updated 17 Sep 2024

Local attackers controlling the slurm user can escalate privileges to root due to incorrect default permissions in the testsuite packaging.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-31251?

CVE-2022-31251 is a medium-severity vulnerability in openSUSE Factory, published on 7 Sep 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE Factory slurm versions prior to 22.05.2-3.3.

Weakness: CWE-276

Which versions are affected by CVE-2022-31251?

It affects 1 product.

Products include Opensuse Factory.

How do I fix CVE-2022-31251?

Apply the vendor's patch.

Is CVE-2022-31251 being exploited?

There is no known exploitation of CVE-2022-31251 in the wild and no public exploit code.

Sources

Also known as GHSA-rw8f-7p48-8m3h, openSUSE-SU-2024:12225-1.