A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-subscription-manager-rhsmUpgrade python3-cloud-whatUpgrade subscription-manager-migrationUpgrade subscription-manager-plugin-ostreeUpgrade subscription-manager-rhsm-certificatesUpgrade dnf-plugin-subscription-managerUpgrade python3-syspurposeUpgrade subscription-managerUpgrade libdnf-plugin-subscription-manager | Aug 24, 2023 | Aug 22, 2023 |
| Centos_linux | — | Upgrade subscription-manager-migrationUpgrade python-syspurposeUpgrade rhsm-gtkUpgrade subscription-manager-plugin-ostreeUpgrade subscription-managerUpgrade subscription-manager-rhsmUpgrade subscription-manager-debuginfoUpgrade subscription-manager-rhsm-certificatesUpgrade subscription-manager-initial-setup-addonUpgrade subscription-manager-cockpitUpgrade subscription-manager-guiUpgrade subscription-manager-plugin-container | Aug 29, 2023 | Aug 23, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-subscription-manager-rhsmUpgrade subscription-manager-cockpitUpgrade python2-subscription-manager-rhsmUpgrade subscription-managerUpgrade subscription-manager-plugin-ostreeUpgrade python3-syspurposeUpgrade subscription-manager-plugin-containerUpgrade subscription-manager-rhsm-certificatesUpgrade dnf-plugin-subscription-manager | Mar 13, 2024 | Aug 23, 2023 |
| Redhat_linux | — | Upgrade python3-subscription-manager-rhsmUpgrade subscription-manager-debuginfoUpgrade subscription-manager-guiUpgrade subscription-manager-cockpitUpgrade rhsm-gtkUpgrade subscription-manager-migrationUpgrade python3-syspurposeUpgrade libdnf-plugin-subscription-manager-debuginfoUpgrade subscription-manager-debugsourceUpgrade subscription-manager-initial-setup-addonUpgrade dnf-plugin-subscription-managerUpgrade rhsm-iconsUpgrade python3-cloud-whatUpgrade subscription-manager-plugin-containerUpgrade python3-subscription-manager-rhsm-debuginfoUpgrade python-syspurposeUpgrade dnf-plugin-subscription-manager-debuginfoUpgrade subscription-manager-rhsm-certificatesUpgrade subscription-manager-rhsmUpgrade subscription-manager-plugin-ostreeUpgrade libdnf-plugin-subscription-managerUpgrade subscription-manager | Aug 29, 2023 | Aug 23, 2023 |
| Rocky_linux | — | Upgrade dnf-plugin-subscription-managerUpgrade subscription-manager-plugin-ostreeUpgrade subscription-manager-debugsourceUpgrade python3-syspurposeUpgrade subscription-manager-debuginfoUpgrade libdnf-plugin-subscription-manager-debuginfoUpgrade subscription-managerUpgrade subscription-manager-migrationUpgrade dnf-plugin-subscription-manager-debuginfoUpgrade python3-subscription-manager-rhsm-debuginfoUpgrade python3-cloud-whatUpgrade libdnf-plugin-subscription-managerUpgrade python3-subscription-manager-rhsmUpgrade subscription-manager-rhsm-certificates | Mar 5, 2024 | Aug 23, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub