A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade subscription-manager-rhsm-certificatesUpgrade python3-syspurposeUpgrade libdnf-plugin-subscription-managerUpgrade subscription-managerUpgrade dnf-plugin-subscription-managerUpgrade subscription-manager-plugin-ostreeUpgrade python3-subscription-manager-rhsmUpgrade subscription-manager-migrationUpgrade python3-cloud-what | Aug 24, 2023 | Aug 22, 2023 |
| Centos_linux | — | Upgrade subscription-manager-migrationUpgrade rhsm-gtkUpgrade subscription-managerUpgrade python-syspurposeUpgrade subscription-manager-plugin-ostreeUpgrade subscription-manager-initial-setup-addonUpgrade subscription-manager-cockpitUpgrade subscription-manager-rhsmUpgrade subscription-manager-debuginfoUpgrade subscription-manager-plugin-containerUpgrade subscription-manager-guiUpgrade subscription-manager-rhsm-certificates | Aug 29, 2023 | Aug 23, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade subscription-manager-cockpitUpgrade python2-subscription-manager-rhsmUpgrade python3-subscription-manager-rhsmUpgrade subscription-manager-plugin-ostreeUpgrade subscription-managerUpgrade python3-syspurposeUpgrade dnf-plugin-subscription-managerUpgrade subscription-manager-rhsm-certificatesUpgrade subscription-manager-plugin-container | Mar 13, 2024 | Aug 23, 2023 |
| Redhat_linux | — | Upgrade subscription-managerUpgrade subscription-manager-rhsmUpgrade subscription-manager-plugin-ostreeUpgrade libdnf-plugin-subscription-managerUpgrade subscription-manager-plugin-containerUpgrade dnf-plugin-subscription-manager-debuginfoUpgrade subscription-manager-rhsm-certificatesUpgrade python-syspurposeUpgrade rhsm-iconsUpgrade python3-cloud-whatUpgrade dnf-plugin-subscription-managerUpgrade python3-subscription-manager-rhsm-debuginfoUpgrade subscription-manager-debugsourceUpgrade rhsm-gtkUpgrade python3-syspurposeUpgrade subscription-manager-migrationUpgrade subscription-manager-cockpitUpgrade subscription-manager-debuginfoUpgrade python3-subscription-manager-rhsmUpgrade libdnf-plugin-subscription-manager-debuginfoUpgrade subscription-manager-initial-setup-addonUpgrade subscription-manager-gui | Aug 29, 2023 | Aug 23, 2023 |
| Rocky_linux | — | Upgrade python3-syspurposeUpgrade subscription-manager-debuginfoUpgrade dnf-plugin-subscription-managerUpgrade libdnf-plugin-subscription-manager-debuginfoUpgrade subscription-managerUpgrade subscription-manager-debugsourceUpgrade subscription-manager-plugin-ostreeUpgrade python3-subscription-manager-rhsm-debuginfoUpgrade python3-subscription-manager-rhsmUpgrade subscription-manager-migrationUpgrade libdnf-plugin-subscription-managerUpgrade subscription-manager-rhsm-certificatesUpgrade dnf-plugin-subscription-manager-debuginfoUpgrade python3-cloud-what | Mar 5, 2024 | Aug 23, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub