CVE-2021-32000 : What You Need to Know

A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allows local attackers to delete arbitrary files.

Understanding CVE-2021-32000

This CVE involves dangerous file system operations in the clone-master-clean-up script of select SUSE Linux Enterprise Server and openSUSE Factory versions.

What is CVE-2021-32000?

CVE-2021-32000 is a vulnerability that allows local attackers to delete arbitrary files by exploiting a UNIX Symbolic Link (Symlink) Following issue in specific versions of SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1, and openSUSE Factory.

The Impact of CVE-2021-32000

The impact of this vulnerability is classified as LOW. However, it can lead to unauthorized deletion of files by local attackers, potentially disrupting system operations and causing data loss.

Technical Details of CVE-2021-32000

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The vulnerability arises from improper link resolution before file access, also known as 'Link Following', allowing attackers to delete arbitrary files.

Affected Systems and Versions

SUSE Linux Enterprise Server 12 SP3 clone-master-clean-up version 1.6-4.6.1 and prior versions
SUSE Linux Enterprise Server 15 SP1 clone-master-clean-up version 1.6-3.9.1 and prior versions
openSUSE Factory clone-master-clean-up version 1.6-1.4 and prior versions

Exploitation Mechanism

Local attackers can exploit this vulnerability to delete arbitrary files on affected systems by manipulating symbolic links.

Mitigation and Prevention

To secure systems against CVE-2021-32000, immediate steps and long-term security practices are recommended.

Immediate Steps to Take

Apply patches provided by SUSE for the affected versions immediately to mitigate the vulnerability.
Regularly monitor system files and directories for unexpected changes.

Long-Term Security Practices

Implement least privilege access controls to limit the impact of potential file deletions by attackers.
Conduct regular security audits and assessments to identify and remediate vulnerabilities proactively.

Patching and Updates

Ensure that the clone-master-clean-up script in the affected versions of SUSE Linux Enterprise Server and openSUSE Factory is updated to patched versions to prevent exploitation of the vulnerability.