PT-2022-20639 · Keylime+1 · Keylime+1

Johannes Segitz · Published 2022-07-20 · Updated 2022-11-08 · CVE-2022-31250

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions keylime versions prior to 6.4.2-1.1

Description A UNIX Symbolic Link (Symlink) Following issue in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root.

Recommendations For versions prior to 6.4.2-1.1, update to version 6.4.2-1.1 or later to resolve the issue.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2022-31250

OPENSUSE-SU-2022_2658-1

OPENSUSE-SU-2024:12153-1

SUSE-SU-2022:2658-1

Affected Products

Suse

Keylime

References · 13

• 🔥 https://bugzilla.suse.com/show_bug.cgi?id=1200885 · Exploit
• https://osv.dev/vulnerability/CVE-2022-31250 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2658-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31250 · Security Note
• https://suse.com/support/update/announcement/2022/suse-su-20222658-1 · Note
• https://bugzilla.suse.com/1201866 · Note
• https://bugzilla.suse.com/1201466 · Note
• https://suse.com/security/cve/CVE-2022-31250 · Note
• https://t.me/cvenotify/33450 · Telegram Post
• https://t.me/cibsecurity/46632 · Telegram Post
• https://bugzilla.suse.com/1199253 · Note
• https://suse.com/security/cve/CVE-2022-1053 · Note
• https://bugzilla.suse.com/1200885 · Note