PT-2023-32868 · Kylinsoft · Kylin-System-Updater

Glzjin · Published 2023-12-24 · Updated 2024-05-17 · CVE-2023-7093

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KylinSoft kylin-system-updater versions up to 2.0.5.16-0k2.33

Description A critical vulnerability has been found in the KylinSoft kylin-system-updater. The issue is related to the manipulation of the SetDownloadspeedMax argument, which leads to os command injection. This can be exploited locally. The exploit has been disclosed to the public.

Recommendations For KylinSoft kylin-system-updater versions up to 2.0.5.16-0k2.33, as a temporary workaround, consider restricting access to the SetDownloadspeedMax argument in the /usr/share/kylin-system-updater/SystemUpdater/UpgradeStrategiesDbus.py file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-7093

Affected Products

Kylin-System-Updater

References · 9

• 🔥 https://note.zhaoj.in/share/L1hGe9BDlbnt · Exploit
• https://osv.dev/vulnerability/CVE-2023-7093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7093 · Security Note
• https://t.me/cvenotify/66431 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1739095490765942979 · Twitter Post
• https://t.me/cvenotify/65066 · Telegram Post
• https://twitter.com/CVEnew/status/1739067851888062729 · Twitter Post
• https://vuldb.com/?ctiid.248940 · Note
• https://vuldb.com/?id.248940 · Note