UNIX symbolic link following in Salt - CVE-2023-34049

Vulnerability identifier: #VU82944

CSH Severity: Low

CVSS v4: 8.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

CVE-ID: CVE-2023-34049

CWE-ID: CWE-61

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a symlink following issue in Salt-SSH pre-flight option. A local user can create a specially crafted symbolic link to an empty file on the system, wait for the salt to create the file for further execution, update the symbolic link and point it to another file that is under attacker's control and execute the file with root privileges.

Salt
Gentoo Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE CaaS Platform
SUSE Manager Server Module
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy Module
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Manager Client Tools for SLE Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
SUSE Manager Client Tools for RHEL, Liberty and Clones
Fedora
SUSE Manager Client Tools for Debian
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise High Performance Computing
Transactional Server Module
Basesystem Module
Server Applications Module
openSUSE Leap
ObjectScale
python3-simplejson-debuginfo
python2-simplejson
python-simplejson-debuginfo
python-simplejson-debugsource
python3-simplejson
python2-simplejson-debuginfo
release-notes-susemanager-proxy
release-notes-susemanager
spacecmd
salt
salt-common
salt-minion
venv-salt-minion
salt-master
salt-bash-completion
salt-proxy
salt-standalone-formulas-configuration
salt-cloud
salt-api
salt-syndic
salt-doc
python3-salt
salt-ssh
salt-transactional-update
salt-zsh-completion
salt-fish-completion
python3-salt-testsuite
app-admin/salt

Install updates from vendor's website.

Salt - addressed in versions 3005.4, 3006.4
ObjectScale - update to 1.4.0
python3-simplejson-debuginfo - update to 3.17.2-150300.3.4.1
python2-simplejson - update to 3.17.2-150300.3.4.1
python-simplejson-debuginfo - update to 3.17.2-150300.3.4.1
python-simplejson-debugsource - update to 3.17.2-150300.3.4.1
python3-simplejson - update to 3.17.2-150300.3.4.1
python2-simplejson-debuginfo - update to 3.17.2-150300.3.4.1
release-notes-susemanager-proxy - update to 4.3.9-150400.3.69.1
release-notes-susemanager - update to 4.3.9-150400.3.90.1
spacecmd - update to 4.3.25-2.60.1
salt - addressed in versions 3005.4-1.el9, 3005.4-1.fc37, 3006.4-1.fc38, 3006.4-1.fc39
salt-common - update to 3006.0+ds-1+2.94.1
salt-minion - addressed in versions 3006.0+ds-1+2.94.1, 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
venv-salt-minion - addressed in versions 3006.0-1.30.3, 3006.0-2.6.3, 3006.0-2.44.4, 3006.0-2.46.4, 3006.0-3.46.2, 3006.0-150000.3.48.2
salt-master - addressed in versions 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
salt-bash-completion - addressed in versions 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
salt-proxy - addressed in versions 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
salt-standalone-formulas-configuration - addressed in versions 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
salt-cloud - addressed in versions 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
salt-api - addressed in versions 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
salt-syndic - addressed in versions 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
salt-doc - addressed in versions 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
python3-salt - addressed in versions 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
salt-ssh - addressed in versions 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
salt-transactional-update - addressed in versions 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
salt - addressed in versions 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
salt-zsh-completion - addressed in versions 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
salt-fish-completion - addressed in versions 3006.0-150100.112.1, 3006.0-150200.113.1, 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
python3-salt-testsuite - addressed in versions 3006.0-150300.53.65.2, 3006.0-150400.8.49.2, 3006.0-150500.4.24.2
app-admin/salt - update to 3006.6

• https://saltproject.io/security-announcements/2023-10-27-advisory/

• Privilege escalation in Salt
• SUSE update for Maintenance update for SUSE Manager 4.3.9 Release Notes
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• SUSE update for salt
• Fedora 39 update for salt
• Fedora EPEL 9 update for salt
• Fedora 37 update for salt
• Fedora 38 update for salt
• SUSE update for SUSE Manager Salt Bundle
• SUSE update for SUSE Manager Salt Bundle
• SUSE update for SUSE Manager Salt Bundle
• SUSE update for SUSE Manager Salt Bundle
• SUSE update for SUSE Manager Salt Bundle
• SUSE update for SUSE Manager Salt Bundle
• SUSE update for SUSE Manager Client Tools
• Multiple vulnerabilities in Dell ObjectScale
• Gentoo update for Salt