Upstream information

CVE-2026-25701 at MITRE

Description

An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like:
* gain access to possible private information found in /var/lib/pcrlock.d
* manipulate the data backed up in /tmp/pcrlock.d.bak, therefore violating the integrity of the data should it be restored.
* overwrite protected system files with data from /var/lib/pcrlock.d by placing symlinks to existing files in the directory tree in /tmp/pcrlock.d.bak.


This issue affects sdbootutil: from ? before 5880246d3a02642dc68f5c8cb474bf63cdb56bca.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v3 Scores
CVSS detail SUSE
Base Score 7.3
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Impact Low
Integrity Impact High
Availability Impact High
CVSSv3 Version 3.1
CVSS v4 Scores
CVSS detail CNA (SUSE) SUSE
Base Score 7 7
Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Attack Vector Local Local
Attack Complexity Low Low
Attack Requirements None None
Privileges Required Low Low
User Interaction None None
Vulnerable System Confidentiality Impact Low Low
Vulnerable System Integrity Impact High High
Vulnerable System Availability Impact High High
Subsequent System Confidentiality Impact None None
Subsequent System Integrity Impact None None
Subsequent System Availability Impact None None
CVSSv4 Version 4.0 4.0
SUSE Bugzilla entry: 1258241 [CONFIRMED]

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.235
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.199
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.210
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.228
Image SLE-Micro
Image SLE-Micro-Azure
Image SLE-Micro-BYOS
Image SLE-Micro-BYOS-Azure
Image SLE-Micro-BYOS-EC2
Image SLE-Micro-BYOS-GCE
Image SLE-Micro-EC2
Image SLE-Micro-GCE
  • gzip >= 1.13-3.1
Image kiwi-templates-Minimal-kvm-and-xen-encrypt
  • sdbootutil >= 1+git20260506.25d47bf-160000.1.1
  • sdbootutil-dracut-measure-pcr >= 1+git20260506.25d47bf-160000.1.1
  • sdbootutil-enroll >= 1+git20260506.25d47bf-160000.1.1
  • sdbootutil-jeos-firstboot-enroll >= 1+git20260506.25d47bf-160000.1.1
  • sdbootutil-snapper >= 1+git20260506.25d47bf-160000.1.1
SUSE Linux Enterprise Server 16.1
  • sdbootutil >= 1+git20260908.c641fc2-160100.1.2
  • sdbootutil-bash-completion >= 1+git20260908.c641fc2-160100.1.2
  • sdbootutil-dracut-measure-pcr >= 1+git20260908.c641fc2-160100.1.2
  • sdbootutil-enroll >= 1+git20260908.c641fc2-160100.1.2
  • sdbootutil-jeos-firstboot-enroll >= 1+git20260908.c641fc2-160100.1.2
  • sdbootutil-kernel-install >= 1+git20260908.c641fc2-160100.1.2
  • sdbootutil-snapper >= 1+git20260908.c641fc2-160100.1.2
  • sdbootutil-tukit >= 1+git20260908.c641fc2-160100.1.2
 Patchnames:
SUSE Linux Enterprise Server 16.1 GA sdbootutil-1+git20260908.c641fc2-160100.1.2 (aarch64,ppc64le,s390x,x86_64)
SUSE Linux Enterprise Server for SAP applications 16.1
  • sdbootutil >= 1+git20260908.c641fc2-160100.1.2
  • sdbootutil-bash-completion >= 1+git20260908.c641fc2-160100.1.2
  • sdbootutil-dracut-measure-pcr >= 1+git20260908.c641fc2-160100.1.2
  • sdbootutil-enroll >= 1+git20260908.c641fc2-160100.1.2
  • sdbootutil-jeos-firstboot-enroll >= 1+git20260908.c641fc2-160100.1.2
  • sdbootutil-kernel-install >= 1+git20260908.c641fc2-160100.1.2
  • sdbootutil-snapper >= 1+git20260908.c641fc2-160100.1.2
  • sdbootutil-tukit >= 1+git20260908.c641fc2-160100.1.2
 Patchnames:
SUSE Linux Enterprise Server for SAP applications 16.1 GA sdbootutil-1+git20260908.c641fc2-160100.1.2 (aarch64,ppc64le,s390x,x86_64)
openSUSE Leap 16.0
  • sdbootutil >= 1+git20260506.25d47bf-160000.1.1
  • sdbootutil-bash-completion >= 1+git20260506.25d47bf-160000.1.1
  • sdbootutil-dracut-measure-pcr >= 1+git20260506.25d47bf-160000.1.1
  • sdbootutil-enroll >= 1+git20260506.25d47bf-160000.1.1
  • sdbootutil-jeos-firstboot-enroll >= 1+git20260506.25d47bf-160000.1.1
  • sdbootutil-kernel-install >= 1+git20260506.25d47bf-160000.1.1
  • sdbootutil-snapper >= 1+git20260506.25d47bf-160000.1.1
  • sdbootutil-tukit >= 1+git20260506.25d47bf-160000.1.1
 Patchnames:
openSUSE-Leap-16.0-868
openSUSE Tumbleweed
  • sdbootutil >= 1+git20260303.90d816d-1.1
  • sdbootutil-bash-completion >= 1+git20260303.90d816d-1.1
  • sdbootutil-dracut-measure-pcr >= 1+git20260303.90d816d-1.1
  • sdbootutil-enroll >= 1+git20260303.90d816d-1.1
  • sdbootutil-jeos-firstboot-enroll >= 1+git20260303.90d816d-1.1
  • sdbootutil-kernel-install >= 1+git20260303.90d816d-1.1
  • sdbootutil-snapper >= 1+git20260303.90d816d-1.1
  • sdbootutil-tukit >= 1+git20260303.90d816d-1.1
 Patchnames:
openSUSE-Tumbleweed-2026-10287

SUSE Timeline for this CVE

CVE page created: Mon Feb 16 14:15:20 2026
CVE page last modified: Wed Oct 28 13:59:55 2026