CVE-2025-54882: 
Linux openSUSE vulnerability analysis and mitigation

CVE-2025-54882 is a world-readable Kerberos credential cache vulnerability in Himmelblau, an interoperability suite for Microsoft Azure Entra ID and Intune. Affected versions include 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0. The vulnerability was discovered and disclosed on August 6–7, 2025, with patches released the same day. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-522 (Insufficiently Protected Credentials). When a user logs on via an Azure Entra ID account, Himmelblau stores the cloud Ticket Granting Ticket (TGT) in a Kerberos credential cache directory (e.g., /tmp/krb5cc_%{uid}) configured via /etc/krb5.conf.d/krb5_himmelblau.conf. Both the directory (created with drwxr-xr-x permissions owned by root) and the credential files within it (e.g., primary, tkt) are written with world-readable permissions (-rw-r--r--), allowing any local user to read them. The fix, applied in commits b562053 and faae58b, introduces a create_ccache_dir function that creates the directory with mode 0o700 and writes credential files with mode 0o600 (GitHub Advisory, Patch Commit).

A local attacker with low-privilege access to the system can read any logged-on user's cloud TGT from the world-readable credential cache, enabling impersonation of that user and unauthorized access to Azure Entra ID-protected resources. The vulnerability has high confidentiality and integrity impact — stolen TGTs can be used in pass-the-ticket attacks to authenticate to cloud services, potentially enabling lateral movement within an organization's Azure/Intune environment. Availability is not directly impacted (GitHub Advisory).

The vulnerability requires only low-privilege local access and no user interaction, making it straightforward to exploit on any multi-user system running a vulnerable Himmelblau version. A proof-of-concept is referenced in the GitHub Security Advisory (GHSA-phfx-rjfw-wj83), consisting of simple filesystem inspection steps. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.011% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a multi-user Linux system (e.g., OpenSUSE Tumbleweed) running Himmelblau versions 0.8.0–0.9.21 or 1.0.0-beta–1.1.0 with at least one Azure Entra ID user logged in.
2. Locate credential cache: As any local user, list the /tmp/ directory to find world-readable Kerberos cache directories: ls -l /tmp/ | grep krb5cc_.
3. Read TGT files: Access the credential cache directory and read the ticket file: cat /tmp/krb5cc_<uid>/tkt or copy the binary TGT file for offline use.
4. Import stolen TGT: Use a Kerberos tool (e.g., KRB5CCNAME=/tmp/krb5cc_<uid> klist) to inspect the ticket, then import it into an attacker-controlled credential cache: cp /tmp/krb5cc_<uid>/tkt /tmp/attacker_cache/tkt.
5. Pass-the-ticket: Set KRB5CCNAME to the copied cache and use tools such as curl, kinit, or Azure CLI to authenticate to Entra ID-protected resources as the victim user, achieving unauthorized access or lateral movement (GitHub Advisory).

• File System: Presence of world-readable directories matching /tmp/krb5cc_<uid>/ with permissions drwxr-xr-x owned by root; credential files (primary, tkt, cloud_tkt) within those directories with permissions -rw-r--r-- — both are indicators of a vulnerable or unpatched installation.
• File System: Unexpected copies of Kerberos ticket files (e.g., tkt) in directories outside /tmp/krb5cc_<uid>/, particularly in directories owned by non-victim users.
• Logs: System audit logs (auditd) showing read access to /tmp/krb5cc_*/tkt or /tmp/krb5cc_*/primary by users other than the file owner.
• Network: Unexpected authentication events in Azure Entra ID audit logs from known user accounts originating from unusual source IPs or devices not associated with that user (GitHub Advisory).

Upgrade Himmelblau to version 0.9.22 (for the 0.x branch) or 1.2.0 (for the 1.x branch), both released on August 6–7, 2025, which fix the credential cache directory and file permissions to 0o700 and 0o600 respectively (Release 0.9.22, Release 1.2.0). As an immediate workaround on unpatched systems, remove world-read access from all existing credential cache files: sudo chmod 600 /tmp/krb5cc_*/* and sudo chmod 700 /tmp/krb5cc_*/. Additionally, implement file integrity monitoring or auditd rules on /tmp/krb5cc_*/ to detect unauthorized access (GitHub Advisory).

The vulnerability was reported by security researcher Samuel Cabrero (scabrero) and published by maintainer dmulder via GitHub's security advisory process. Red Hat tracked the issue for their distributions. The CISA weekly vulnerability bulletin for the week of August 4, 2025 included this CVE. Coverage was limited to automated vulnerability aggregators and security feeds, with no significant broader media or social media discussion noted (Red Hat CVE, CISA Bulletin).