Bug 2208377 (CVE-2023-32313)

Summary:	CVE-2023-32313 vm2: Inspect Manipulation
Product:	[Other] Security Response	Reporter:	Borja Tarraso <btarraso>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dkuc, fjansen, gparvin, hkataria, kshier, njean, owatkins, pahickey, stcannon, teagle
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	vm2 3.9.18	Doc Type:	---
Doc Text:	A flaw was found in the vm2. After making a vm, the inspect method is read-write for console.log, which allows an attacker to edit options for console.log. This issue impacts the integrity by changing the log subsystem.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-30 22:33:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2208382
Bug Blocks:	2208369

Description Borja Tarraso 2023-05-18 18:48:41 UTC

vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit options for the `console.log` command. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. Users unable to upgrade may make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm.

Comment 3 errata-xmlrpc 2023-05-24 15:23:46 UTC

This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.2 for RHEL 8

Via RHSA-2023:3296 https://access.redhat.com/errata/RHSA-2023:3296

Comment 4 errata-xmlrpc 2023-05-24 18:04:05 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.7 for RHEL 8

Via RHSA-2023:3297 https://access.redhat.com/errata/RHSA-2023:3297

Comment 5 errata-xmlrpc 2023-05-25 16:23:49 UTC

This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.1 for RHEL 8

Via RHSA-2023:3325 https://access.redhat.com/errata/RHSA-2023:3325

Comment 6 errata-xmlrpc 2023-05-26 07:56:04 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8

Via RHSA-2023:3326 https://access.redhat.com/errata/RHSA-2023:3326

Comment 7 errata-xmlrpc 2023-05-30 16:49:07 UTC

This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.0 for RHEL 8

Via RHSA-2023:3353 https://access.redhat.com/errata/RHSA-2023:3353

Comment 8 errata-xmlrpc 2023-05-30 21:02:14 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8

Via RHSA-2023:3356 https://access.redhat.com/errata/RHSA-2023:3356

Comment 9 Product Security DevOps Team 2023-05-30 22:33:12 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-32313