VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 7, 2022· Updated Sep 17, 2024

slurm: %post for slurm-testsuite operates as root in user owned directory

CVE-2022-31251

Description

Local privilege escalation in openSUSE Factory slurm testsuite packaging allows slurm user to gain root via race condition during package update.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Local privilege escalation in openSUSE Factory slurm testsuite packaging allows slurm user to gain root via race condition during package update.

Vulnerability

A incorrect default permissions vulnerability exists in the packaging of the slurm testsuite for openSUSE Factory. The directory /srv/slurm-testsuite is owned by the slurm user, but the %post scriptlet in the RPM package runs as root and performs a tar extraction from a file (slurmtest.tar.bz2) located in that same directory. This allows a local attacker with control over the slurm user to escalate privileges to root. Affected versions are openSUSE Factory slurm prior to 22.05.2-3.3 [1].

Exploitation

An attacker must have local access as the slurm user. During a package update (or initial installation), the %post scriptlet copies slurmtest.tar.bz2 into /srv/slurm-testsuite and then extracts it with tar --same-owner -C /srv/slurm-testsuite -xjf. Because the directory is writable by slurm, the attacker can use a race condition: after the file is written but before tar reads it, the attacker can delete the legitimate archive and replace it with a malicious one. The proof-of-concept in [1] uses inotifywait to detect the file close event, then replaces the archive with a crafted tarball containing many directories (e.g., 10,000) to increase the race window. The tar extraction then runs as root, creating files and directories owned by root under the attacker's control.

Impact

Successful exploitation allows the slurm user to create arbitrary files and directories on the system with root ownership. This can be leveraged to achieve full root compromise, for example by overwriting system binaries or configuration files. The impact is a complete loss of confidentiality, integrity, and availability.

Mitigation

The vulnerability is fixed in slurm version 22.05.2-3.3 for openSUSE Factory. Users should update to this version or later. No workaround is documented. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

References
  1. %post for slurm-testsuite operates as root in user owned directory

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

57

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

1

News mentions

0

No linked articles in our index yet.