arpwatch: Local privilege escalation from runtime user to root
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SUSE | SUSE Linux Enterprise Server 11-SP4-LTSS | arpwatch to before 2.1a15 | 2.1a15 | Patch available | CNA |
| SUSE | SUSE Manager Server 4.0 | arpwatch to before 2.1a15 | 2.1a15 | Patch available | CNA |
| SUSE | SUSE OpenStack Cloud Crowbar 9 | arpwatch to before 2.1a15 | 2.1a15 | Patch available | CNA |
| openSUSE | Factory | arpwatch – 2.1a15-169.5 | — | No fix listed | CNA |
| openSUSE | Leap 15.2 | arpwatch – 2.1a15-lp152.5.5 | — | No fix listed | CNA |
- SUSE Linux Enterprise Server 11-SP4-LTSS VendorSUSE Affected arpwatch to before 2.1a15 Fixed in 2.1a15 Patch available CNA
- SUSE Manager Server 4.0 VendorSUSE Affected arpwatch to before 2.1a15 Fixed in 2.1a15 Patch available CNA
- SUSE OpenStack Cloud Crowbar 9 VendorSUSE Affected arpwatch to before 2.1a15 Fixed in 2.1a15 Patch available CNA
- Factory VendoropenSUSE Affected arpwatch – 2.1a15-169.5 Fixed in — No fix listed CNA
- Leap 15.2 VendoropenSUSE Affected arpwatch – 2.1a15-lp152.5.5 Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:suse:arpwatch:*:*:*:*:*:*:*:* | before 2.1a15 | Vulnerable | SUSE |
| cpe:2.3:a:suse:manager_server:4.0:*:*:*:*:*:*:* | 4.0 | Running on | SUSE |
| cpe:2.3:a:suse:openstack_cloud_crowbar:9.0:*:*:*:*:*:*:* | 9.0 | Running on | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss:*:*:* | 11 sp4 | Running on | SUSE |
| cpe:2.3:a:suse:arpwatch:*:*:*:*:*:*:*:* | up to 2.1a15-169.5 | Vulnerable | SUSE |
| cpe:2.3:a:opensuse:factory:-:*:*:*:*:*:*:* | not specified by NVD | Running on | openSUSE |
| cpe:2.3:a:suse:arpwatch:*:*:*:*:*:*:*:* | up to 2.1a15-lp152.5.5 | Vulnerable | SUSE |
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | 15.2 | Running on | openSUSE |
- cpe:2.3:a:suse:arpwatch:*:*:*:*:*:*:*:* Versions before 2.1a15 Vulnerable ·SUSE
- cpe:2.3:a:suse:manager_server:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·SUSE
- cpe:2.3:a:suse:openstack_cloud_crowbar:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss:*:*:* Versions 11 sp4 Running on ·SUSE
- cpe:2.3:a:suse:arpwatch:*:*:*:*:*:*:*:* Versions up to 2.1a15-169.5 Vulnerable ·SUSE
- cpe:2.3:a:opensuse:factory:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·openSUSE
- cpe:2.3:a:suse:arpwatch:*:*:*:*:*:*:*:* Versions up to 2.1a15-lp152.5.5 Vulnerable ·SUSE
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Running on ·openSUSE
Remediation
- Fix · CNA SUSE Linux Enterprise Server 11-SP4-LTSS (SUSE) Fixed in 2.1a15
- Fix · CNA SUSE Manager Server 4.0 (SUSE) Fixed in 2.1a15
- Fix · CNA SUSE OpenStack Cloud Crowbar 9 (SUSE) Fixed in 2.1a15
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 3 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2021-25321
- 2026-10-03 Alias added: GHSA-p5jf-rf9m-p26h
References
Sources
- CVE-2021-25321 · CVE Program
- CVE-2021-25321 · NVD
- FIRST EPSS
- GHSA-p5jf-rf9m-p26h · GitHub Advisory Database · CC BY 4.0
- CVE-2021-25321 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences