Security update for acl, attr
This update for acl, attr fixes the following issue: - CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr, getfacl/setfacl/chacl, libacl (bsc#1268867). Changes for acl: - Update to 2.4.0 (jsc#PED-16501): Major Issues Fixed: - The libacl library functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() take a pathname argument and follow symbolic links. When a privileged user calls one of those functions, an attacker that controls a pathname component can replace a file or directory with a symbolic link and redirect the operation to a different file. This can lead to local privilege escalation. (CVE-2026-54369, bsc#1268867) The library functions cannot be fixed without breaking compatibility; the described behaviour is by design. Instead, version 2.4.0 of the acl package introduces the additional functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and acl_delete_def_file_at(). These functions each take a dirfd file descriptor argument and an at_flags argument and accept the AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to control when to follow symbolic links. (CVE-2026-54370, bsc#1268867) In addition, the libacl functions acl_get_fd(), acl_set_fd(), and acl_extended_fd() functions always operate on the access ACL; the library previously did not offer a way to operate on the default ACL of a directory file descriptor. The new functions remove that restr
SUSE-SU-2026:23670-1
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:SUSE-SU-2026:23670-1
acl
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.4.0-160000.1.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
attr
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.6.0-160000.1.1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.0-160000.1.1"
}
]
}
],
"package": {
"name": "acl",
"purl": "pkg:rpm/suse/acl&distro=SUSE%20Linux%20Micro%206.2",
"ecosystem": "SUSE:Linux Micro 6.2"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23670-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"acl": "2.4.0-160000.1.1",
"attr": "2.6.0-160000.1.1",
"libacl1": "2.4.0-160000.1.1",
"libattr1": "2.6.0-160000.1.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.0-160000.1.1"
}
]
}
],
"package": {
"name": "attr",
"purl": "pkg:rpm/suse/attr&distro=SUSE%20Linux%20Micro%206.2",
"ecosystem": "SUSE:Linux Micro 6.2"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23670-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"acl": "2.4.0-160000.1.1",
"attr": "2.6.0-160000.1.1",
"libacl1": "2.4.0-160000.1.1",
"libattr1": "2.6.0-160000.1.1"
}
]
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #30797 · Revision 1
- Added to Heist Feed
- Publisher date