PT-2023-8876 · Unknown+9 · Openpmix Pmix+9

Francois Diakhate · Published 2023-09-09 · Updated 2024-08-20 · CVE-2023-41915

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenPMIx PMIx versions 4.2.6 and earlier, 5.0.x before 5.0.1

Description The issue is related to a race condition during the execution of library code with UID 0, allowing attackers to obtain ownership of arbitrary files. This can potentially lead to unauthorized access to confidential data.

Recommendations For OpenPMIx PMIx versions 4.2.6 and earlier, update to version 4.2.6 or later. For OpenPMIx PMIx 5.0.x before 5.0.1, update to version 5.0.1 or later.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALSA-2024:2199

ALSA-2024:3008

AZL-29702

BDU:2024-02538

CESA-2024_3008

CVE-2023-41915

DLA-3643-1

DSA-5547-1

INFSA-2024_2199

INFSA-2024_3008

MGASA-2024-0162

OESA-2023-1676

OPENSUSE-SU-2023_3859-1

OPENSUSE-SU-2024:13223-1

RHSA-2024:2199

RHSA-2024:3008

RHSA-2024_2199

RHSA-2024_3008

RLSA-2024:3008

SUSE-SU-2023:3859-1

SUSE-SU-2023_3859-1

USN-6434-1

Affected Products

Almalinux

Astra Linux

Centos

Linuxmint

Openpmix Pmix

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 61

• https://errata.almalinux.org/8/ALSA-2024-3008.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41915 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFKIY6SNC3KQNZMVROWMIW6DI5XPNKQX · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-3008.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41915 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYJ7IRNR6NHJMTNOV3E3W3D5MLDRDCJX · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-2199.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02538 · Security Note
• https://osv.dev/vulnerability/DSA-5547-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0162 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6434-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-29702 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1676 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDLWSMQYXF2ZGOQKCG26H6ZZA5FEH7HX · Vendor Advisory