A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade subscription-manager-plugin-ostreeUpgrade python3-syspurposeUpgrade subscription-manager-rhsm-certificatesUpgrade subscription-managerUpgrade libdnf-plugin-subscription-managerUpgrade dnf-plugin-subscription-managerUpgrade subscription-manager-migrationUpgrade python3-subscription-manager-rhsmUpgrade python3-cloud-what | Aug 24, 2023 | Aug 22, 2023 |
| Centos_linux | — | Upgrade python-syspurposeUpgrade rhsm-gtkUpgrade subscription-managerUpgrade subscription-manager-plugin-ostreeUpgrade subscription-manager-migrationUpgrade subscription-manager-debuginfoUpgrade subscription-manager-plugin-containerUpgrade subscription-manager-rhsm-certificatesUpgrade subscription-manager-initial-setup-addonUpgrade subscription-manager-cockpitUpgrade subscription-manager-guiUpgrade subscription-manager-rhsm | Aug 29, 2023 | Aug 23, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-subscription-manager-rhsmUpgrade python2-subscription-manager-rhsmUpgrade subscription-manager-cockpitUpgrade subscription-manager-plugin-ostreeUpgrade dnf-plugin-subscription-managerUpgrade subscription-manager-rhsm-certificatesUpgrade subscription-managerUpgrade subscription-manager-plugin-containerUpgrade python3-syspurpose | Mar 13, 2024 | Aug 23, 2023 |
| Redhat_linux | — | Upgrade python3-subscription-manager-rhsm-debuginfoUpgrade subscription-managerUpgrade dnf-plugin-subscription-managerUpgrade subscription-manager-rhsm-certificatesUpgrade python3-cloud-whatUpgrade rhsm-iconsUpgrade libdnf-plugin-subscription-managerUpgrade subscription-manager-rhsmUpgrade subscription-manager-plugin-containerUpgrade subscription-manager-plugin-ostreeUpgrade dnf-plugin-subscription-manager-debuginfoUpgrade python-syspurposeUpgrade subscription-manager-cockpitUpgrade libdnf-plugin-subscription-manager-debuginfoUpgrade subscription-manager-guiUpgrade subscription-manager-debuginfoUpgrade python3-subscription-manager-rhsmUpgrade python3-syspurposeUpgrade subscription-manager-debugsourceUpgrade rhsm-gtkUpgrade subscription-manager-migrationUpgrade subscription-manager-initial-setup-addon | Aug 29, 2023 | Aug 23, 2023 |
| Rocky_linux | — | Upgrade python3-subscription-manager-rhsm-debuginfoUpgrade dnf-plugin-subscription-manager-debuginfoUpgrade subscription-manager-migrationUpgrade python3-cloud-whatUpgrade python3-subscription-manager-rhsmUpgrade libdnf-plugin-subscription-managerUpgrade subscription-manager-rhsm-certificatesUpgrade subscription-manager-debuginfoUpgrade subscription-manager-plugin-ostreeUpgrade subscription-manager-debugsourceUpgrade libdnf-plugin-subscription-manager-debuginfoUpgrade python3-syspurposeUpgrade dnf-plugin-subscription-managerUpgrade subscription-manager | Mar 5, 2024 | Aug 23, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub