CVE-2025-3931 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2025-3931 Interim 1 5 2026-03-05T01:32:32Z current 2025-05-20T23:15:21Z 2026-03-05T01:32:32Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2025-3931 A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes through the DBus component. Yggdrasil creates a DBus method to dispatch messages to workers. However, it misses authentication and authorization checks, allowing every system user to call it. One available Yggdrasil worker acts as a package manager with capabilities to create and enable new repositories and install or remove packages. This flaw allows an attacker with access to the system to leverage the lack of authentication on the dispatch message to force the Yggdrasil worker to install arbitrary RPM packages. This issue results in local privilege escalation, enabling the attacker to access and modify sensitive system data. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QOPKRPL75SZMLT3YSQAZEDWH7RBRXGJK/ E-Mail link for openSUSE-SU-2025:15135-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE SUSE Linux Enterprise Server 16.0 openSUSE Tumbleweed gnutls-3.8.3-slfo.1.1_5.1 govulncheck-vulndb-0.0.20250515T200012-1.1 govulncheck-vulndb-0.0.20250814T182633-160000.1.2 libgnutls30-3.8.3-slfo.1.1_5.1 gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-RT libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-RT-SelfInstall libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-RT-encrypted libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-SelfInstall libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-encrypted libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-qcow gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-SelfInstall libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-SelfInstall gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-encrypted libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-encrypted gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-qcow libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-qcow libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-Azure libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-BYOS libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-BYOS-Azure libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-BYOS-EC2 libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-BYOS-GCE libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-EC2 libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-GCE govulncheck-vulndb-0.0.20250814T182633-160000.1.2 as a component of SUSE Linux Enterprise Server 16.0 govulncheck-vulndb-0.0.20250515T200012-1.1 as a component of openSUSE Tumbleweed A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes through the DBus component. Yggdrasil creates a DBus method to dispatch messages to workers. However, it misses authentication and authorization checks, allowing every system user to call it. One available Yggdrasil worker acts as a package manager with capabilities to create and enable new repositories and install or remove packages. This flaw allows an attacker with access to the system to leverage the lack of authentication on the dispatch message to force the Yggdrasil worker to install arbitrary RPM packages. This issue results in local privilege escalation, enabling the attacker to access and modify sensitive system data. CVE-2025-3931 Image SL-Micro:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-RT:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-RT-SelfInstall:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-RT-encrypted:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-SelfInstall:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-VMware:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-encrypted:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-qcow:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-SelfInstall:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-SelfInstall:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-VMware:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-VMware:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-encrypted:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-encrypted:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-qcow:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-qcow:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-Azure:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-BYOS:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-BYOS-Azure:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-BYOS-EC2:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-BYOS-GCE:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-EC2:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-GCE:libgnutls30-3.8.3-slfo.1.1_5.1 SUSE Linux Enterprise Server 16.0:govulncheck-vulndb-0.0.20250814T182633-160000.1.2 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250515T200012-1.1 important