Bug 2225407 (CVE-2023-3899) - CVE-2023-3899 subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration
Summary: CVE-2023-3899 subscription-manager: inadequate authorization of com.redhat.RH...
Keywords:
Status: NEW
Alias: CVE-2023-3899
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2225440 2225441 2225442 2225443 2225444 2225445 2225446 2229752 2229753 2229754 2233724 2233725
Blocks: 2224941
TreeView+ depends on / blocked
 
Reported: 2023-07-25 09:22 UTC by TEJ RATHI
Modified: 2024-05-17 05:04 UTC (History)
10 users (show)

Fixed In Version: subscription-manager 1.29.37, subscription-manager 1.28.36
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2023:4711 0 None None None 2023-08-23 08:28:11 UTC
Red Hat Product Errata RHBA-2023:4712 0 None None None 2023-08-23 08:30:38 UTC
Red Hat Product Errata RHBA-2023:4713 0 None None None 2023-08-23 08:30:36 UTC
Red Hat Product Errata RHBA-2023:4714 0 None None None 2023-08-23 08:32:52 UTC
Red Hat Product Errata RHBA-2023:4715 0 None None None 2023-08-23 08:49:14 UTC
Red Hat Product Errata RHBA-2023:4721 0 None None None 2023-08-23 14:25:57 UTC
Red Hat Product Errata RHBA-2023:4722 0 None None None 2023-08-23 14:26:13 UTC
Red Hat Product Errata RHBA-2023:4723 0 None None None 2023-08-23 14:35:04 UTC
Red Hat Product Errata RHBA-2023:4726 0 None None None 2023-08-23 20:02:34 UTC
Red Hat Product Errata RHBA-2023:4729 0 None None None 2023-08-24 07:36:48 UTC
Red Hat Product Errata RHBA-2023:4738 0 None None None 2023-08-24 14:03:33 UTC
Red Hat Product Errata RHBA-2023:4739 0 None None None 2023-08-24 14:03:14 UTC
Red Hat Product Errata RHBA-2023:4740 0 None None None 2023-08-24 14:08:58 UTC
Red Hat Product Errata RHBA-2023:4741 0 None None None 2023-08-24 14:15:52 UTC
Red Hat Product Errata RHBA-2023:4743 0 None None None 2023-08-24 14:08:04 UTC
Red Hat Product Errata RHBA-2023:4744 0 None None None 2023-08-24 14:10:24 UTC
Red Hat Product Errata RHBA-2023:4747 0 None None None 2023-08-24 17:20:25 UTC
Red Hat Product Errata RHBA-2023:4750 0 None None None 2023-08-24 19:02:17 UTC
Red Hat Product Errata RHBA-2023:4761 0 None None None 2023-08-28 09:27:11 UTC
Red Hat Product Errata RHBA-2023:4763 0 None None None 2023-08-28 11:08:39 UTC
Red Hat Product Errata RHBA-2023:4764 0 None None None 2023-08-28 11:20:23 UTC
Red Hat Product Errata RHBA-2023:4776 0 None None None 2023-08-28 15:22:44 UTC
Red Hat Product Errata RHBA-2023:4778 0 None None None 2023-08-28 16:00:24 UTC
Red Hat Product Errata RHBA-2023:4781 0 None None None 2023-08-28 18:11:10 UTC
Red Hat Product Errata RHBA-2023:4837 0 None None None 2023-08-29 11:25:49 UTC
Red Hat Product Errata RHBA-2023:4869 0 None None None 2023-08-30 05:41:40 UTC
Red Hat Product Errata RHBA-2023:4870 0 None None None 2023-08-30 06:10:17 UTC
Red Hat Product Errata RHBA-2023:4871 0 None None None 2023-08-30 06:52:42 UTC
Red Hat Product Errata RHBA-2023:4882 0 None None None 2023-08-30 15:23:37 UTC
Red Hat Product Errata RHBA-2023:4886 0 None None None 2023-08-30 16:42:10 UTC
Red Hat Product Errata RHBA-2023:4932 0 None None None 2023-08-31 19:16:41 UTC
Red Hat Product Errata RHBA-2023:4936 0 None None None 2023-09-04 01:15:28 UTC
Red Hat Product Errata RHBA-2023:4937 0 None None None 2023-09-04 01:07:21 UTC
Red Hat Product Errata RHBA-2023:4938 0 None None None 2023-09-04 12:05:08 UTC
Red Hat Product Errata RHBA-2023:4979 0 None None None 2023-09-05 14:43:41 UTC
Red Hat Product Errata RHBA-2023:4989 0 None None None 2023-09-06 11:33:39 UTC
Red Hat Product Errata RHBA-2023:4992 0 None None None 2023-09-06 14:25:22 UTC
Red Hat Product Errata RHBA-2023:5105 0 None None None 2023-09-12 15:07:09 UTC
Red Hat Product Errata RHBA-2023:5406 0 None None None 2023-09-28 20:22:35 UTC
Red Hat Product Errata RHSA-2023:4701 0 None None None 2023-08-22 16:00:02 UTC
Red Hat Product Errata RHSA-2023:4702 0 None None None 2023-08-22 15:41:33 UTC
Red Hat Product Errata RHSA-2023:4703 0 None None None 2023-08-22 15:51:58 UTC
Red Hat Product Errata RHSA-2023:4704 0 None None None 2023-08-22 15:59:38 UTC
Red Hat Product Errata RHSA-2023:4705 0 None None None 2023-08-22 16:30:02 UTC
Red Hat Product Errata RHSA-2023:4706 0 None None None 2023-08-22 16:31:46 UTC
Red Hat Product Errata RHSA-2023:4707 0 None None None 2023-08-22 16:17:05 UTC
Red Hat Product Errata RHSA-2023:4708 0 None None None 2023-08-22 16:30:42 UTC

Description TEJ RATHI 2023-07-25 09:22:11 UTC 
The DBus interface com.redhat.RHSM1 exposes a significant number of methods to all users that will change the state of the registration. A non-privileged user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. By using the com.redhat.RHSM1.Config.SetAll() method, an unprivileged user can perform a local privilege escalation to unconfined root.
Comment 4 TEJ RATHI 2023-08-18 11:25:40 UTC 
Statement:

The vulnerable method SetAll() allows the non-root user to Local Privilege Escalation. The vulnerable method is present since subscription-manager-1.26.15-1. Currently, RHEL-8.2. and above contains the vulnerable code.

However, before the SetAll() was introduced, the worst thing that could happen is to unregister the system and cut off system from updates. No privilege escalation is possible in RHEL-7.9, and RHEL-8.1 as those streams ships subscription-manager-1.25.17.1-1 and prior. Making it Moderate issue for those streams.

So, the vulnerability has always been there, the SetAll() method that introduced with later version in subscription-manager turned it to a to Local Privilege Escalation.
Comment 6 TEJ RATHI 2023-08-22 14:00:54 UTC 
Lifting Embargo, This CVE is now public.
https://access.redhat.com/security/cve/CVE-2023-3899
Comment 7 errata-xmlrpc 2023-08-22 15:41:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2023:4702 https://access.redhat.com/errata/RHSA-2023:4702
Comment 8 errata-xmlrpc 2023-08-22 15:51:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2023:4703 https://access.redhat.com/errata/RHSA-2023:4703
Comment 9 errata-xmlrpc 2023-08-22 15:59:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2023:4704 https://access.redhat.com/errata/RHSA-2023:4704
Comment 10 errata-xmlrpc 2023-08-22 16:00:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2023:4701 https://access.redhat.com/errata/RHSA-2023:4701
Comment 11 errata-xmlrpc 2023-08-22 16:17:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:4707 https://access.redhat.com/errata/RHSA-2023:4707
Comment 12 errata-xmlrpc 2023-08-22 16:30:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:4705 https://access.redhat.com/errata/RHSA-2023:4705
Comment 13 errata-xmlrpc 2023-08-22 16:30:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4708 https://access.redhat.com/errata/RHSA-2023:4708
Comment 14 errata-xmlrpc 2023-08-22 16:31:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4706 https://access.redhat.com/errata/RHSA-2023:4706
Comment 15 TEJ RATHI 2023-08-23 06:35:38 UTC 
Created subscription-manager tracking bugs for this issue:

Affects: fedora-37 [bug 2233724]
Affects: fedora-38 [bug 2233725]
Note You need to log in before you can comment on or make changes to this bug.