sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2022-31254 rmt-server-pubcloud allows to escalate from user _rmt to root

High 7.8 Published Updated

Local attackers with _rmt user access can escalate privileges to root due to incorrect default permissions in the rmt-server-regsharing service.

Exploited in the wild
Not known
Login needed
Any signed-in user
Attackable
Local or same network only
Victim action needed
Not needed
Fix
Available

What is CVE-2022-31254?

CVE-2022-31254 is a high-severity vulnerability in SUSE Linux Enterprise Server for SAP 15, published on 7 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Manager Server 4.1; openSUSE Leap 15.3, openSUSE Leap 15.4 allows local attackers with access to the _rmt user to escalate to root. This issue affects: SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.10. SUSE Linux Enterprise Server for SAP 15-SP1 rmt-server versions prior to 2.10. SUSE Manager Server 4.1 rmt-server versions prior to 2.10. openSUSE Leap 15.3 rmt-server versions prior to 2.10. openSUSE Leap 15.4 rmt-server versions prior to 2.10.

Weakness: CWE-276

Which versions are affected by CVE-2022-31254?

It affects 1 product.

Linux distribution packages (35)
rmt-server SUSE:Enterprise Storage 6All versions2.10-150100.3.42.1
rmt-server SUSE:Enterprise Storage 7All versions2.10-150200.3.29.1
rmt-server SUSE:Enterprise Storage 7.1All versions2.10-150300.3.21.1
rmt-server SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSSAll versions2.10-150100.3.42.1
rmt-server SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSSAll versions2.10-150200.3.29.1
rmt-server SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOSAll versions2.10-150300.3.21.1
rmt-server SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSSAll versions2.10-150300.3.21.1
rmt-server SUSE:Linux Enterprise High Performance Computing 15-ESPOSAll versions2.10-150000.3.61.1
rmt-server SUSE:Linux Enterprise High Performance Computing 15-LTSSAll versions2.10-150000.3.61.1
rmt-server SUSE:Linux Enterprise Module for Public Cloud 15 SP1All versions2.10-150100.3.42.1
rmt-server SUSE:Linux Enterprise Module for Public Cloud 15 SP2All versions2.10-150200.3.29.1
rmt-server SUSE:Linux Enterprise Module for Public Cloud 15 SP3All versions2.10-150300.3.21.1
rmt-server SUSE:Linux Enterprise Module for Public Cloud 15 SP4All versions2.10-150400.3.9.1
rmt-server SUSE:Linux Enterprise Module for Server Applications 15 SP3All versions2.10-150300.3.21.1
rmt-server SUSE:Linux Enterprise Module for Server Applications 15 SP4All versions2.10-150400.3.9.1
rmt-server SUSE:Linux Enterprise Real Time 15 SP3All versions2.10-150300.3.21.1
rmt-server SUSE:Linux Enterprise Server 15 SP1-BCLAll versions2.10-150100.3.42.1
rmt-server SUSE:Linux Enterprise Server 15 SP1-LTSSAll versions2.10-150100.3.42.1
rmt-server SUSE:Linux Enterprise Server 15 SP2-BCLAll versions2.10-150200.3.29.1
rmt-server SUSE:Linux Enterprise Server 15 SP2-LTSSAll versions2.10-150200.3.29.1
rmt-server SUSE:Linux Enterprise Server 15 SP3-BCLAll versions2.10-150300.3.21.1
rmt-server SUSE:Linux Enterprise Server 15 SP3-LTSSAll versions2.10-150300.3.21.1
rmt-server SUSE:Linux Enterprise Server 15-LTSSAll versions2.10-150000.3.61.1
rmt-server SUSE:Linux Enterprise Server for SAP Applications 15All versions2.10-150000.3.61.1
rmt-server SUSE:Linux Enterprise Server for SAP Applications 15 SP1All versions2.10-150100.3.42.1
rmt-server SUSE:Linux Enterprise Server for SAP Applications 15 SP2All versions2.10-150200.3.29.1
rmt-server SUSE:Linux Enterprise Server for SAP Applications 15 SP3All versions2.10-150300.3.21.1
rmt-server SUSE:Manager Proxy 4.1All versions2.10-150200.3.29.1
rmt-server SUSE:Manager Proxy 4.2All versions2.10-150300.3.21.1
rmt-server SUSE:Manager Retail Branch Server 4.1All versions2.10-150200.3.29.1
rmt-server SUSE:Manager Retail Branch Server 4.2All versions2.10-150300.3.21.1
rmt-server SUSE:Manager Server 4.1All versions2.10-150200.3.29.1
rmt-server SUSE:Manager Server 4.2All versions2.10-150300.3.21.1
rmt-server openSUSE:Leap 15.3All versions2.10-150300.3.21.1
rmt-server openSUSE:Leap 15.4All versions2.10-150400.3.9.1

Products include Opensuse Rmt-Server.

How do I fix CVE-2022-31254?

Apply the vendor's patch.

Is CVE-2022-31254 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31254 exists.

Sources

Also known as GHSA-hqw6-rjpx-2wf4, SUSE-SU-2023:0019-1, SUSE-SU-2023:0020-1, SUSE-SU-2023:0021-1, SUSE-SU-2023:0022-1, SUSE-SU-2023:0023-1.

Is CVE-2022-31254 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free