Local privilege escalation from user wwwrun to root in the packaging of mailman

Vulnerability

The mailman package on SUSE Linux Enterprise Server 11, 12, and openSUSE Leap 15.1 contains a symlink following vulnerability in its post-installation script. During package upgrade or reinstallation, the script executes chown wwwrun.mailman on the file %{varmmdir}/logs/error. If the kernel parameter fs.protected_hardlinks is set to 0, a local user in the mailman group can replace this log file with a hard link to an arbitrary file, causing the chown operation to change the group ownership of the target file to mailman. Affected versions: SUSE Linux Enterprise Server 11 (mailman prior to 2.1.15-9.6.15.1), SUSE Linux Enterprise Server 12 (mailman prior to 2.1.17-3.11.1), and openSUSE Leap 15.1 (mailman version 2.1.29-lp151.2.14 and prior). [1]

Exploitation

An attacker must have local access as a user in the mailman group (or as wwwrun). The attacker removes the existing error file in /var/lib/mailman/logs/ and creates a hard link from that path to a target file (e.g., /etc/shadow). When the mailman package is reinstalled or upgraded (e.g., via zypper in -f mailman), the post-install script runs chown wwwrun.mailman on the hard-linked path, changing the group ownership of the target file to mailman. This allows the attacker to read the file if it has group read permissions. [1]

Impact

A local attacker in the mailman group can change the group ownership of arbitrary files to mailman, potentially gaining read access to sensitive system files such as /etc/shadow. Additionally, a user running as wwwrun can leverage the same vector to escalate privileges to root, as the chown operation is performed with root privileges. [1]

Mitigation

Fixed versions are available: SUSE Linux Enterprise Server 11 (mailman 2.1.15-9.6.15.1 and later), SUSE Linux Enterprise Server 12 (mailman 2.1.17-3.11.1 and later), and openSUSE Leap 15.1 (mailman later than 2.1.29-lp151.2.14). As a workaround, system administrators can set the kernel parameter fs.protected_hardlinks=1 to prevent hardlink attacks. [1]