A privilege escalation vulnerability was found in haveged.
                                                                                                                                                                                                                                           
The socket_handler() function in src/havegecmd.c checks the connecting
peer's uid via SO_PEERCRED and sends a NAK response to non-root callers.
However, after sending the NAK, execution continued into the command    
switch instead of returning. This allowed unprivileged local users to                                                                                                                                                                    
send commands (MAGIC_CHROOT, MAGIC_CLOSE) to the root-running daemon 
via the abstract UNIX socket.                                                                                                                                                                                                            
                                                                                                                                                          
Affected: all versions with command socket support (1.9.14+)
                                                                                                                                                                                                                             
Upstream fix: https://github.com/jirka-h/haveged/releases/tag/v1.9.21
Fix commit: https://github.com/jirka-h/haveged/commit/3870de0                                                                                                                                                                            
SUSE bug: https://bugzilla.suse.com/show_bug.cgi?id=1264086  
                                                                                                                                                                                                                                   
Fixed in: haveged-1.9.21-1 (rawhide, f44, f43, f42, epel9, epel10)
Fixed in: haveged-1.9.14-2 (epel8, backported patch)