PT-2023-8876 · Unknown+9 · Openpmix Pmix+9

Francois Diakhate · Publicado 2023-09-09 · Atualizado 2024-08-20 · CVE-2023-41915

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenPMIx PMIx versions 4.2.6 and earlier, 5.0.x before 5.0.1

Description The issue is related to a race condition during the execution of library code with UID 0, allowing attackers to obtain ownership of arbitrary files. This can potentially lead to unauthorized access to confidential data.

Recommendations For OpenPMIx PMIx versions 4.2.6 and earlier, update to version 4.2.6 or later. For OpenPMIx PMIx 5.0.x before 5.0.1, update to version 5.0.1 or later.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

ALSA-2024:2199

ALSA-2024:3008

AZL-29702

BDU:2024-02538

CESA-2024_3008

CVE-2023-41915

DLA-3643-1

DSA-5547-1

INFSA-2024_2199

INFSA-2024_3008

MGASA-2024-0162

OESA-2023-1676

OPENSUSE-SU-2023_3859-1

OPENSUSE-SU-2024:13223-1

RHSA-2024:2199

RHSA-2024:3008

RHSA-2024_2199

RHSA-2024_3008

RLSA-2024:3008

SUSE-SU-2023:3859-1

SUSE-SU-2023_3859-1

USN-6434-1

Produtos afetados

Almalinux

Astra Linux

Centos

Linuxmint

Openpmix Pmix

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Referências · 61

• https://github.com/openpmix/openpmix/releases/tag/v4.2.6 · Nota
• https://github.com/openpmix/openpmix/releases/tag/v5.0.1 · Nota
• https://github.com/openpmix/openpmix/commit/da036933c2795c1f40d0835e15f17e204e4daf0f · Nota
• https://github.com/openpmix/openpmix/commit/0bf9801a3017eb6ca411e158da39570ccb998c17 · Nota
• http://openwall.com/lists/oss-security/2024/07/10/4 · Nota
• https://errata.almalinux.org/8/ALSA-2024-3008.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-41915 · Aviso do Fabricante
• https://bugzilla.suse.com/1215190 · Nota
• https://suse.com/support/update/announcement/2023/suse-su-20233859-1 · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFKIY6SNC3KQNZMVROWMIW6DI5XPNKQX · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2023-41915 · Nota
• https://linux.oracle.com/errata/ELSA-2024-3008.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-41915 · Nota de Segurança
• https://t.me/cvenotify/57884 · Publicação no Telegram
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYJ7IRNR6NHJMTNOV3E3W3D5MLDRDCJX · Aviso do Fabricante