CVE-2022-31256: 
NixOS vulnerability analysis and mitigation

CVE-2022-31256 is a privilege escalation vulnerability discovered in the sendmail package, specifically affecting the sm-client.pre script. The vulnerability was found during a sendmail audit and affects various SUSE Linux Enterprise versions. The issue stems from an Improper Link Resolution Before File Access ('Link Following') in a script called by the sendmail systemd service (SUSE Bugzilla).

The vulnerability exists in the /usr/lib/systemd/system/sendmail-client.service where the sm-client.pre script runs as root. The script creates a pidfile in /var/spool/clientmqueue/sm-client.pid and then changes ownership to mail:mail. Since the directory is owned by mail:mail, attackers can perform a symlink attack to escalate privileges to root (SUSE Bugzilla).

The vulnerability allows local users to escalate privileges from group smmsp to root through a symlink attack. This could potentially give attackers full system access and control (SUSE Bugzilla).

The vulnerability requires local access and is considered to have low attack complexity. The attack vector is local, requiring no special privileges for exploitation (SUSE Bugzilla).

SUSE has released security updates to address this vulnerability. The fixes were implemented through SR#1031106 for affected versions. Multiple SUSE Linux Enterprise versions received patches through SUSE-SU-2022:3899-1 and SUSE-SU-2022:3898-1 updates (SUSE Bugzilla).