In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Novell |
|
| Suse |
|
No data.
No data.
References
History
Thu, 21 May 2026 08:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Novell
Novell suse Linux Enterprise For Sap Applications Suse Suse container Suse/sle-micro Suse container Suse/sle-micro-rancher Suse image Sles15-sp4-sap-byos Suse image Sles15-sp4-sap-byos-azure Suse image Sles15-sp4-sap-byos-ec2 Suse image Sles15-sp4-sap-byos-gce Suse image Sles15-sp4-sap-hardened Suse image Sles15-sp4-sap-hardened-byos Suse image Sles15-sp4-sap-hardened-byos-azure Suse image Sles15-sp4-sap-hardened-byos-ec2 Suse image Sles15-sp4-sap-hardened-byos-gce Suse image Sles15-sp4-sap-hardened-gce Suse linux Enterprise High Performance Computing Suse linux Enterprise Micro Suse manager Proxy Suse manager Retail Branch Server Suse manager Server Suse suse Linux Enterprise Desktop Suse suse Linux Enterprise Module For Basesystem Suse suse Linux Enterprise Server |
|
| Vendors & Products |
Novell
Novell suse Linux Enterprise For Sap Applications Suse Suse container Suse/sle-micro Suse container Suse/sle-micro-rancher Suse image Sles15-sp4-sap-byos Suse image Sles15-sp4-sap-byos-azure Suse image Sles15-sp4-sap-byos-ec2 Suse image Sles15-sp4-sap-byos-gce Suse image Sles15-sp4-sap-hardened Suse image Sles15-sp4-sap-hardened-byos Suse image Sles15-sp4-sap-hardened-byos-azure Suse image Sles15-sp4-sap-hardened-byos-ec2 Suse image Sles15-sp4-sap-hardened-byos-gce Suse image Sles15-sp4-sap-hardened-gce Suse linux Enterprise High Performance Computing Suse linux Enterprise Micro Suse manager Proxy Suse manager Retail Branch Server Suse manager Server Suse suse Linux Enterprise Desktop Suse suse Linux Enterprise Module For Basesystem Suse suse Linux Enterprise Server |
Wed, 20 May 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 20 May 2026 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 20 May 2026 10:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`. | |
| Title | Missing exit out of permission check in haveged could lead to root exploit | |
| Weaknesses | CWE-305 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: suse
Published: 2026-05-20T08:56:14.466Z
Updated: 2026-05-21T03:55:33.848Z
Reserved: 2026-04-16T13:37:50.680Z
Link: CVE-2026-41054
Vulnrichment
Updated: 2026-05-20T09:09:33.506Z
NVD
Status : Awaiting Analysis
Published: 2026-05-20T10:16:26.990
Modified: 2026-05-20T14:25:57.283
Link: CVE-2026-41054
Redhat
No data.