Bug 2185374 (CVE-2023-29017)

Summary:	CVE-2023-29017 vm2: sandbox escape
Product:	[Other] Security Response	Reporter:	Nick Tait <ntait>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	dkuc, fcanogab, fjansen, gparvin, hkataria, kshier, njean, owatkins, pahickey, stcannon, teagle
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	vm2 3.9.15	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in vm2 where the component was not properly handling asynchronous errors. This flaw allows a remote, unauthenticated attacker to escape the restrictions of the sandbox and execute code on the host.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-04-20 07:05:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2185935
Bug Blocks:	2185238

Description Nick Tait 2023-04-08 15:52:41 UTC

https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv

Comment 2 Nick Tait 2023-04-08 15:55:15 UTC

Patch is here https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50

Comment 7 errata-xmlrpc 2023-04-19 23:50:24 UTC

This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.2 for RHEL 8

Via RHSA-2023:1887 https://access.redhat.com/errata/RHSA-2023:1887

Comment 8 errata-xmlrpc 2023-04-20 01:39:27 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.7 for RHEL 8

Via RHSA-2023:1888 https://access.redhat.com/errata/RHSA-2023:1888

Comment 9 errata-xmlrpc 2023-04-20 01:52:15 UTC

This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.0 for RHEL 8

Via RHSA-2023:1893 https://access.redhat.com/errata/RHSA-2023:1893

Comment 10 errata-xmlrpc 2023-04-20 01:54:11 UTC

This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.1 for RHEL 8

Via RHSA-2023:1894 https://access.redhat.com/errata/RHSA-2023:1894

Comment 11 errata-xmlrpc 2023-04-20 02:16:23 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8

Via RHSA-2023:1897 https://access.redhat.com/errata/RHSA-2023:1897

Comment 12 errata-xmlrpc 2023-04-20 02:16:30 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8

Via RHSA-2023:1896 https://access.redhat.com/errata/RHSA-2023:1896

Comment 13 Product Security DevOps Team 2023-04-20 07:05:08 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-29017