Read the docs
TI-2022-06306 Aliases CVE-2022-21944GHSA-rg42-3854-x575

watchman: chown in [email protected] unit allows symlink attack

Priority LOW 34CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman versions prior to 4.9.0-9.1.

Why it matters now

EPSS 0.00287 21st percentileScored 2026-11-07
Fix Fixed openSUSE Backports SLE-15-SP3 (openSUSE): 4.9.0Factory (openSUSE): 4.9.0-9.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
openSUSEopenSUSE Backports SLE-15-SP3watchman to before 4.9.04.9.0Patch availableCNA
openSUSEFactorywatchman to before 4.9.0-9.14.9.0-9.1Patch availableCNA
  • openSUSE Backports SLE-15-SP3 VendoropenSUSE Affected watchman to before 4.9.0 Fixed in 4.9.0 Patch available CNA
  • Factory VendoropenSUSE Affected watchman to before 4.9.0-9.1 Fixed in 4.9.0-9.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:opensuse:factory_watchman:*:*:*:*:*:*:*:*up to 4.9.1VulnerableopenSUSE
cpe:2.3:o:suse:suse_linux_enterprise_server:15:sp3:*:*:*:*:*:*15 sp3Running onSUSE
  • cpe:2.3:a:opensuse:factory_watchman:*:*:*:*:*:*:*:* Versions up to 4.9.1 Vulnerable ·openSUSE
  • cpe:2.3:o:suse:suse_linux_enterprise_server:15:sp3:*:*:*:*:*:* Versions 15 sp3 Running on ·SUSE

Remediation

  • Fix · CNA openSUSE Backports SLE-15-SP3 (openSUSE) Fixed in 4.9.0
  • Fix · CNA Factory (openSUSE) Fixed in 4.9.0-9.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-21944
  2. 2026-10-03 Alias added: GHSA-rg42-3854-x575

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences