جزئیات آسیبپذیری
CVE-2026-41054
SUSE Container suse/sle-micro-rancher/ :latestSUSE Container suse/sle-micro/ :latestSUSE Image SLES15- -SAP-BYOSSUSE Image SLES15- -SAP-BYOS-AzureSUSE Image SLES15- -SAP-BYOS-EC2SUSE Image SLES15- -SAP-BYOS-GCE
Missing exit out of permission check in haveged could lead to root exploit
CVSS 3.1
7.8بالا
شرح رسمی (انگلیسی)
In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.8بالا | 3.1 | CVEProject cvelistV5 (CNA) (suse) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
محصولات آسیبپذیر
| فروشنده | محصول | نسخهها | منبع |
|---|---|---|---|
| SUSE | Container suse/sle-micro-rancher/5.3:latest | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Container suse/sle-micro-rancher/5.3:latest | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Container suse/sle-micro-rancher/5.4:latest | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Container suse/sle-micro-rancher/5.4:latest | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Container suse/sle-micro/5.5:latest | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Container suse/sle-micro/5.5:latest | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-BYOS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-BYOS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-BYOS-Azure | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-BYOS-Azure | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-BYOS-EC2 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-BYOS-EC2 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-BYOS-GCE | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-BYOS-GCE | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-Hardened | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-Hardened | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-Hardened-BYOS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-Hardened-BYOS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-Hardened-BYOS-Azure | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-Hardened-BYOS-Azure | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-Hardened-BYOS-EC2 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-Hardened-BYOS-EC2 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-Hardened-BYOS-GCE | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-Hardened-BYOS-GCE | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-Hardened-GCE | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | Image SLES15-SP4-SAP-Hardened-GCE | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Desktop 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Desktop 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Desktop 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise High Performance Computing 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Micro 5.3 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Micro 5.3 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Micro 5.4 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Micro 5.4 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Micro 5.5 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Micro 5.5 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Module for Basesystem 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Module for Basesystem 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Module for Basesystem 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP4-LTSS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP4-LTSS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP4-LTSS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP5-LTSS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP5-LTSS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP5-LTSS | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP6-LTSS | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP6-LTSS | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP6-LTSS | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP4 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP4 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP4 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP5 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP5 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP5 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP6 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP6 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP6 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Linux Enterprise Server for SAP Applications 15 SP7 | ? ≤ v < 1.9.14-150600.11.6.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Proxy LTS 4.3 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Proxy LTS 4.3 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Proxy LTS 4.3 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Retail Branch Server LTS 4.3 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Retail Branch Server LTS 4.3 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Retail Branch Server LTS 4.3 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Server LTS 4.3 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Server LTS 4.3 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
| SUSE | SUSE Manager Server LTS 4.3 | ? ≤ v < 1.9.14-150400.3.11.1 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۸- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41054
- http://www.openwall.com/lists/oss-security/2026/05/19/3
- http://www.openwall.com/lists/oss-security/2026/05/19/4
- http://www.openwall.com/lists/oss-security/2026/05/19/5
- http://www.openwall.com/lists/oss-security/2026/05/20/1
- http://www.openwall.com/lists/oss-security/2026/05/21/17
- http://www.openwall.com/lists/oss-security/2026/05/22/1
- https://lists.debian.org/debian-lts-announce/2026/06/msg00005.html
کانال تلگرام کُلون @kolunsec_fa
تازههای KEV، خبرهای مهم و خلاصهی روزانه
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیبپذیریهای تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۲/۳۰
- آخرین بهروزرسانی
- ۱۴۰۵/۰۳/۱۵
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- suse
پیشبینی بهرهبرداری (EPSS)
۰٫۱۸٪
احتمال بهرهبرداری در ۳۰ روز
۸٫۱٪
صدک (نسبت به همهی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهرهبرداری
- ندارد
- اثر فنی
- کامل
ضعفها (CWE)
- CWE-305Authentication Bypass by Primary Weakness