GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CERTFR-2022-AVI-086

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans pkexec de PolicyKit sur SUSE. Elle permet à un attaquant de provoquer une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
SUSE N/A SUSE OpenStack Cloud Crowbar versions 8 sans le correctif SUSE-OpenStack-Cloud-Crowbar-8-2022-189
SUSE SUSE Linux Enterprise High Performance Computing SUSE Linux Enterprise High Performance Computing versions 15 SP1-ESPOS sans le correctif SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-191
SUSE N/A SUSE OpenStack Cloud versions 8 sans le correctif SUSE-OpenStack-Cloud-8-2022-189
SUSE N/A SUSE OpenStack Cloud versions 9 sans le correctif SUSE-OpenStack-Cloud-9-2022-189
SUSE SUSE Manager Retail Branch Server SUSE Manager Retail Branch Server versions 4.1 sans le correctif SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-190
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server versions 15 SP1-LTSS sans le correctif SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-191
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server versions 15-LTSS sans le correctif SUSE-SLE-Product-SLES-15-2022-191
SUSE SUSE Linux Enterprise High Performance Computing SUSE Linux Enterprise High Performance Computing versions 15 SP1-LTSS sans le correctif SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-191
SUSE N/A SUSE Enterprise Storage versions 7 sans le correctif SUSE-Storage-7-2022-190
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server versions 12 SP5 sans le correctif SUSE-SLE-SERVER-12-SP5-2022-189
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server versions 12 SP3-LTSS sans le correctif SUSE-SLE-SERVER-12-SP3-2022-189
SUSE N/A SUSE CaaS Platform versions 4.0 sans le correctif SUSE-SUSE-CAASP-4.0-2022-191
SUSE SUSE Linux Enterprise Micro SUSE Linux Enterprise Micro versions 5.0 sans le correctif SUSE-SUSE-MicroOS-5.0-2022-190
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server for SAP Applications versions 15 SP1 sans le correctif SUSE-SLE-Product-SLES_SAP-15-SP1-2022-191
SUSE SUSE Linux Enterprise High Performance Computing SUSE Linux Enterprise High Performance Computing versions 15-LTSS sans le correctif SUSE-SLE-Product-HPC-15-2022-191
SUSE N/A HPE Helion Openstack versions 8 sans le correctif HPE-Helion-OpenStack-8-2022-189
SUSE SUSE Linux Enterprise High Performance Computing SUSE Linux Enterprise High Performance Computing versions 15 SP2-ESPOS sans le correctif SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-190
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server versions 15 SP2-LTSS sans le correctif SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-190
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server for SAP Applications versions 12 SP5 sans le correctif SUSE-SLE-SERVER-12-SP5-2022-189
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server for SAP Applications versions 12 SP4 sans le correctif SUSE-SLE-SAP-12-SP4-2022-189
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server versions 12 SP3-BCL sans le correctif SUSE-SLE-SERVER-12-SP3-BCL-2022-189
SUSE SUSE Linux Enterprise High Performance Computing SUSE Linux Enterprise High Performance Computing versions 15 SP2-LTSS sans le correctif SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-190
SUSE SUSE Manager Server SUSE Manager Server versions 4.1 sans le correctif SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-190
SUSE SUSE Linux Enterprise High Performance Computing SUSE Linux Enterprise High Performance Computing versions 15-ESPOS sans le correctif SUSE-SLE-Product-HPC-15-2022-191
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server versions 12 SP4-ESPOS sans le correctif SUSE-SLE-SERVER-12-SP4-ESPOS-2022-189
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server versions 12 SP2-BCL sans le correctif SUSE-SLE-SERVER-12-SP2-BCL-2022-189
SUSE N/A SUSE Linux Enterprise Module for Basesystem versions 15 SP3 sans le correctif SUSE-SLE-Module-Basesystem-15-SP3-2022-190
SUSE N/A SUSE Enterprise Storage versions 6 sans le correctif SUSE-Storage-6-2022-191
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server versions 15 SP1-BCL sans le correctif SUSE-SLE-Product-SLES-15-SP1-BCL-2022-191
SUSE N/A SUSE Linux Enterprise Software Development Kit versions 12 SP5 sans le correctif SUSE-SLE-SDK-12-SP5-2022-189
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server versions 12 SP3-ESPOS sans le correctif SUSE-SLE-SERVER-12-SP3-ESPOS-2022-189
SUSE SUSE Manager Proxy SUSE Manager Proxy versions 4.1 sans le correctif SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-190
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server versions 15 SP2-BCL sans le correctif SUSE-SLE-Product-SLES-15-SP2-BCL-2022-190
SUSE N/A SUSE Linux Enterprise Workstation Extension versions 12 SP5 sans le correctif SUSE-SLE-WE-12-SP5-2022-189
SUSE SUSE Linux Enterprise Micro SUSE Linux Enterprise Micro versions 5.1 sans le correctif SUSE-SUSE-MicroOS-5.1-2022-190
SUSE N/A SUSE OpenStack Cloud Crowbar versions 9 sans le correctif SUSE-OpenStack-Cloud-Crowbar-9-2022-189
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server for SAP Applications versions 12 SP3 sans le correctif SUSE-SLE-SAP-12-SP3-2022-189
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server versions 12 SP4-LTSS sans le correctif SUSE-SLE-SERVER-12-SP4-LTSS-2022-189
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server for SAP Applications versions 15 sans le correctif SUSE-SLE-Product-SLES_SAP-15-2022-191
SUSE SUSE Linux Enterprise Server SUSE Linux Enterprise Server for SAP Applications versions 15 SP2 sans le correctif SUSE-SLE-Product-SLES_SAP-15-SP2-2022-190
SUSE openSUSE Leap openSUSE Leap versions 15.3 sans le correctif openSUSE-SLE-15.3-2022-190
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SUSE OpenStack Cloud Crowbar versions 8 sans le correctif SUSE-OpenStack-Cloud-Crowbar-8-2022-189",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise High Performance Computing versions 15 SP1-ESPOS sans le correctif SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-191",
      "product": {
        "name": "SUSE Linux Enterprise High Performance Computing",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE OpenStack Cloud versions 8 sans le correctif SUSE-OpenStack-Cloud-8-2022-189",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE OpenStack Cloud versions 9 sans le correctif SUSE-OpenStack-Cloud-9-2022-189",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Manager Retail Branch Server versions 4.1 sans le correctif SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-190",
      "product": {
        "name": "SUSE Manager Retail Branch Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server versions 15 SP1-LTSS sans le correctif SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-191",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server versions 15-LTSS sans le correctif SUSE-SLE-Product-SLES-15-2022-191",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise High Performance Computing versions 15 SP1-LTSS sans le correctif SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-191",
      "product": {
        "name": "SUSE Linux Enterprise High Performance Computing",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Enterprise Storage versions 7 sans le correctif SUSE-Storage-7-2022-190",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server versions 12 SP5 sans le correctif SUSE-SLE-SERVER-12-SP5-2022-189",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server versions 12 SP3-LTSS sans le correctif SUSE-SLE-SERVER-12-SP3-2022-189",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE CaaS Platform versions 4.0 sans le correctif SUSE-SUSE-CAASP-4.0-2022-191",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Micro versions 5.0 sans le correctif SUSE-SUSE-MicroOS-5.0-2022-190",
      "product": {
        "name": "SUSE Linux Enterprise Micro",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server for SAP Applications versions 15 SP1 sans le correctif SUSE-SLE-Product-SLES_SAP-15-SP1-2022-191",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise High Performance Computing versions 15-LTSS sans le correctif SUSE-SLE-Product-HPC-15-2022-191",
      "product": {
        "name": "SUSE Linux Enterprise High Performance Computing",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "HPE Helion Openstack versions 8 sans le correctif HPE-Helion-OpenStack-8-2022-189",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise High Performance Computing versions 15 SP2-ESPOS sans le correctif SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-190",
      "product": {
        "name": "SUSE Linux Enterprise High Performance Computing",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server versions 15 SP2-LTSS sans le correctif SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-190",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server for SAP Applications versions 12 SP5 sans le correctif SUSE-SLE-SERVER-12-SP5-2022-189",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server for SAP Applications versions 12 SP4 sans le correctif SUSE-SLE-SAP-12-SP4-2022-189",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server versions 12 SP3-BCL sans le correctif SUSE-SLE-SERVER-12-SP3-BCL-2022-189",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise High Performance Computing versions 15 SP2-LTSS sans le correctif SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-190",
      "product": {
        "name": "SUSE Linux Enterprise High Performance Computing",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Manager Server versions 4.1 sans le correctif SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-190",
      "product": {
        "name": "SUSE Manager Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise High Performance Computing versions 15-ESPOS sans le correctif SUSE-SLE-Product-HPC-15-2022-191",
      "product": {
        "name": "SUSE Linux Enterprise High Performance Computing",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server versions 12 SP4-ESPOS sans le correctif SUSE-SLE-SERVER-12-SP4-ESPOS-2022-189",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server versions 12 SP2-BCL sans le correctif SUSE-SLE-SERVER-12-SP2-BCL-2022-189",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Module for Basesystem versions 15 SP3 sans le correctif SUSE-SLE-Module-Basesystem-15-SP3-2022-190",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Enterprise Storage versions 6 sans le correctif SUSE-Storage-6-2022-191",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server versions 15 SP1-BCL sans le correctif SUSE-SLE-Product-SLES-15-SP1-BCL-2022-191",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Software Development Kit versions 12 SP5 sans le correctif SUSE-SLE-SDK-12-SP5-2022-189",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server versions 12 SP3-ESPOS sans le correctif SUSE-SLE-SERVER-12-SP3-ESPOS-2022-189",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Manager Proxy versions 4.1 sans le correctif SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-190",
      "product": {
        "name": "SUSE Manager Proxy",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server versions 15 SP2-BCL sans le correctif SUSE-SLE-Product-SLES-15-SP2-BCL-2022-190",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Workstation Extension versions 12 SP5 sans le correctif SUSE-SLE-WE-12-SP5-2022-189",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Micro versions 5.1 sans le correctif SUSE-SUSE-MicroOS-5.1-2022-190",
      "product": {
        "name": "SUSE Linux Enterprise Micro",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE OpenStack Cloud Crowbar versions 9 sans le correctif SUSE-OpenStack-Cloud-Crowbar-9-2022-189",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server for SAP Applications versions 12 SP3 sans le correctif SUSE-SLE-SAP-12-SP3-2022-189",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server versions 12 SP4-LTSS sans le correctif SUSE-SLE-SERVER-12-SP4-LTSS-2022-189",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server for SAP Applications versions 15 sans le correctif SUSE-SLE-Product-SLES_SAP-15-2022-191",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "SUSE Linux Enterprise Server for SAP Applications versions 15 SP2 sans le correctif SUSE-SLE-Product-SLES_SAP-15-SP2-2022-190",
      "product": {
        "name": "SUSE Linux Enterprise Server",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    },
    {
      "description": "openSUSE Leap versions 15.3 sans le correctif openSUSE-SLE-15.3-2022-190",
      "product": {
        "name": "openSUSE Leap",
        "vendor": {
          "name": "SUSE",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-4034",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-4034"
    }
  ],
  "links": [],
  "reference": "CERTFR-2022-AVI-086",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-01-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans pkexec de PolicyKit sur SUSE.\nElle permet \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans pkexec de PolicyKit sur SUSE",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE du 25 janvier 2022",
      "url": "https://www.suse.com/security/cve/CVE-2021-4034.html"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.