CVE-2022-31251: 
NixOS vulnerability analysis and mitigation

CVE-2022-31251 is an Incorrect Default Permissions vulnerability discovered in the packaging of the slurm testsuite of openSUSE Factory. The vulnerability was reported on May 20, 2022, affecting openSUSE Factory slurm versions prior to 22.05.2-3.3 (MITRE, NVD).

The vulnerability exists in the post-installation script of the slurm-testsuite package where root operations are performed in a directory owned by the slurm user. The problematic code executes tar commands with root privileges in /srv/slurm-testsuite, which is owned by the slurm user. This creates a race condition vulnerability during package updates or initial installation (SUSE Bugzilla).

The vulnerability allows local attackers with control over the slurm user to escalate privileges to root. This is achieved by exploiting race conditions during package updates or initial installation, potentially enabling unauthorized access to system resources (MITRE).

The issue was addressed in openSUSE Factory slurm version 22.05.2-3.3. The fix involves ensuring the tar archive is not under a path that the slurm user can influence and performing the unpacking operation with appropriate user privileges. Multiple security updates were released by SUSE to address this vulnerability across different versions (SUSE Bugzilla).