chkstat follows untrusted symbolic links

published 2019-12-05 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-13325

cvss: 6.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits: 0; none known

The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.

Patch / fix

fixed in 1 distros 2

SUSE permissions a9e1d26cd49ef9ee0c2060c859321128a6dd4230

suse opensuse

permissions SLES for SAP 12 SP5, SLES 12 SP5 20170707-6.4.1
permissions SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 20180125-3.21.1
permissions SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 2013.1.7-0.6.5.1
permissions SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +2 more 20170707-3.14.1
permissions SLE Module for Basesystem 15 20180125-3.18.1
permissions SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES 12 SP3-LTSS +8 more 2015.09.28.1626-17.20.1

suse advisories SUSE-SU-2021:2280-1 SUSE-SU-2020:1163-1 SUSE-SU-2019:14237-1 SUSE-SU-2019:3183-1 SUSE-SU-2019:3182-1 SUSE-SU-2019:3180-1

permissions openSUSE Tumbleweed 1550_20210901.1550-29.2
permissions openSUSE Leap 15.1 20181116-lp151.4.9.1

opensuse advisories openSUSE-SU-2024:11165-1 openSUSE-SU-2019:2672-1

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

SUSE permissions

Classification

Weakness

CWE-59 Improper Link Resolution Before File Access

References

lists.opensuse.org /opensuse-security-announce/2019-12/msg00024.html
vendor-advisory, third-party-advisory
bugzilla.suse.com /show_bug.cgi?id=1150734
issue-tracking, third-party-advisory

Sources

CVE List CVE-2019-3690
NVD CVE-2019-3690

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary