CVE-2023-32183
📋 TL;DR
This vulnerability allows users with hacluster group access on openSUSE Tumbleweed systems to escalate privileges to root due to incorrect default permissions in the hawk2 package. It affects openSUSE Tumbleweed installations with the hawk2 package installed. Attackers need existing access to the hacluster account or group to exploit this.
💻 Affected Systems
- openSUSE Tumbleweed hawk2 package
📦 What is this software?
Tumbleweed by Opensuse
⚠️ Risk & Real-World Impact
Worst Case
Full root compromise of affected systems, allowing complete system control, data theft, and lateral movement within the environment.
Likely Case
Privilege escalation from hacluster user to root, enabling installation of persistent backdoors, credential harvesting, and further system compromise.
If Mitigated
Limited impact if proper access controls restrict hacluster group membership and monitoring detects privilege escalation attempts.
🎯 Exploit Status
Exploitation requires existing access to hacluster account/group. The vulnerability is in default permissions, making exploitation straightforward for authenticated attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Updated hawk2 package via openSUSE Tumbleweed updates
Vendor Advisory: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32183
Restart Required: No
Instructions:
1. Run 'sudo zypper update hawk2' 2. Verify the update completed successfully 3. No restart required
🔧 Temporary Workarounds
Restrict hacluster group membership
linuxRemove unnecessary users from hacluster group to reduce attack surface
sudo gpasswd -d username hacluster
Monitor hacluster privilege escalation
linuxImplement auditing for privilege escalation attempts from hacluster users
Add audit rule: auditctl -a always,exit -F arch=b64 -S execve -F euid=0 -F auid>=1000 -F auid!=-1 -k hacluster_priv_esc
🧯 If You Can't Patch
- Strictly limit hacluster group membership to essential users only
- Implement monitoring and alerting for privilege escalation attempts from hacluster accounts
🔍 How to Verify
Check if Vulnerable:
Check if hawk2 package is installed and version is vulnerable: rpm -q hawk2Check Version:
rpm -q hawk2Verify Fix Applied:
Verify updated package version: rpm -q hawk2 | grep -E 'version_with_fix' (check vendor advisory for exact version)📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation from hacluster users
- Failed sudo/root access attempts from hacluster accounts
- Audit logs showing hacluster users gaining root
Network Indicators:
- None - local privilege escalation only
SIEM Query:
source="audit.log" AND (user.hacluster=* AND privilege.escalation=success)