A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade subscription-managerUpgrade libdnf-plugin-subscription-managerUpgrade dnf-plugin-subscription-managerUpgrade python3-syspurposeUpgrade subscription-manager-rhsm-certificatesUpgrade subscription-manager-plugin-ostreeUpgrade python3-cloud-whatUpgrade python3-subscription-manager-rhsmUpgrade subscription-manager-migration | Aug 24, 2023 | Aug 22, 2023 |
| Centos_linux | — | Upgrade subscription-manager-migrationUpgrade subscription-managerUpgrade rhsm-gtkUpgrade python-syspurposeUpgrade subscription-manager-plugin-ostreeUpgrade subscription-manager-initial-setup-addonUpgrade subscription-manager-debuginfoUpgrade subscription-manager-rhsmUpgrade subscription-manager-guiUpgrade subscription-manager-plugin-containerUpgrade subscription-manager-rhsm-certificatesUpgrade subscription-manager-cockpit | Aug 29, 2023 | Aug 23, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade subscription-manager-rhsm-certificatesUpgrade dnf-plugin-subscription-managerUpgrade subscription-manager-plugin-ostreeUpgrade subscription-managerUpgrade subscription-manager-plugin-containerUpgrade python3-syspurposeUpgrade python2-subscription-manager-rhsmUpgrade python3-subscription-manager-rhsmUpgrade subscription-manager-cockpit | Mar 13, 2024 | Aug 23, 2023 |
| Redhat_linux | — | Upgrade python-syspurposeUpgrade dnf-plugin-subscription-manager-debuginfoUpgrade subscription-manager-rhsmUpgrade subscription-manager-plugin-containerUpgrade subscription-manager-plugin-ostreeUpgrade subscription-managerUpgrade python3-subscription-manager-rhsm-debuginfoUpgrade subscription-manager-rhsm-certificatesUpgrade python3-cloud-whatUpgrade rhsm-iconsUpgrade dnf-plugin-subscription-managerUpgrade libdnf-plugin-subscription-managerUpgrade subscription-manager-migrationUpgrade subscription-manager-debugsourceUpgrade libdnf-plugin-subscription-manager-debuginfoUpgrade rhsm-gtkUpgrade python3-subscription-manager-rhsmUpgrade subscription-manager-guiUpgrade python3-syspurposeUpgrade subscription-manager-debuginfoUpgrade subscription-manager-cockpitUpgrade subscription-manager-initial-setup-addon | Aug 29, 2023 | Aug 23, 2023 |
| Rocky_linux | — | Upgrade dnf-plugin-subscription-managerUpgrade libdnf-plugin-subscription-manager-debuginfoUpgrade subscription-managerUpgrade subscription-manager-debugsourceUpgrade python3-syspurposeUpgrade subscription-manager-plugin-ostreeUpgrade subscription-manager-debuginfoUpgrade libdnf-plugin-subscription-managerUpgrade python3-cloud-whatUpgrade dnf-plugin-subscription-manager-debuginfoUpgrade subscription-manager-migrationUpgrade python3-subscription-manager-rhsm-debuginfoUpgrade subscription-manager-rhsm-certificatesUpgrade python3-subscription-manager-rhsm | Mar 5, 2024 | Aug 23, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub