PT-2023-4483 · Red Hat+5 · Subscription-Manager+6

Tej Rathi + 1 · Published 2023-08-22 · Updated 2024-09-16 · CVE-2023-3899

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions subscription-manager (affected versions not specified)

Description A flaw in the authorization procedure of the D-Bus interface com.redhat.RHSM1 allows local privilege escalation. The interface exposes several methods to all users, which can change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user can tamper with the registration state, potentially unregistering the system or changing current entitlements. This issue can be exploited to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, leading to local privilege escalation to an unconfined root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

ALSA-2023:4706

ALSA-2023:4708

AZL-28099

AZL-37046

BDU:2023-04878

CESA-2023_4706

CVE-2023-3899

RHSA-2023:4701

RHSA-2023:4702

RHSA-2023:4703

RHSA-2023:4704

RHSA-2023:4705

RHSA-2023:4706

RHSA-2023:4707

RHSA-2023:4708

RHSA-2023_4701

RHSA-2023_4706

RHSA-2023_4708

RLSA-2023:4706

RLSA-2023:4708

Affected Products

Almalinux

Centos

Red Hat

Red Os

Rocky Linux

Zvirt Node

Subscription-Manager

References · 32

• https://access.redhat.com/errata/RHSA-2023:4703 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ZDIHGNLS3TZVX7X2F735OKI4KXPY4AH6 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04878 · Security Note
• https://access.redhat.com/security/cve/CVE-2023-3899 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:4704 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2225407 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2023:4706 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:4706 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:4706 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2023:4708 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:4701 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:4702 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/FJHKSBBZRDFOBNDU35FUKMYQIQYT6UJQ · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:4708 · Vendor Advisory