Bug 2227027 (CVE-2023-3972)
| Summary: | CVE-2023-3972 insights-client: unsafe handling of temporary files and directories | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | TEJ RATHI <trathi> |
| Component: | vulnerability | Assignee: | Nobody <nobody> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | agk, ahitacat, cmarinea, csi-client-tools-bugs, csnyder, gtanzill, link, ptoscano, redakkan, saroy, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | insights-client 3.2.2 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local user or attacker could create the /var/tmp/insights-client directory (owning the directory with read, write, and execute permissions) on the system. After the insights-client is registered by root, an attacker could then control the directory content that insights are using by putting malicious scripts into it and executing arbitrary code as root (trivially bypassing SELinux protections because insights processes are allowed to disable SELinux system-wide).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | Yes | ||
| Bug Depends On: | 2229674, 2229675, 2229676, 2229677, 2229678, 2229679, 2229680, 2229681, 2229682, 2229683 | ||
| Bug Blocks: | 2222203 | ||
|
Description
TEJ RATHI
2023-07-27 13:18:19 UTC
Making the issue Public. This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Red Hat Enterprise Linux 8.2 Telecommunications Update Service Via RHSA-2023:6264 https://access.redhat.com/errata/RHSA-2023:6264 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:6282 https://access.redhat.com/errata/RHSA-2023:6282 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2023:6284 https://access.redhat.com/errata/RHSA-2023:6284 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:6283 https://access.redhat.com/errata/RHSA-2023:6283 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:6796 https://access.redhat.com/errata/RHSA-2023:6796 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2023:6795 https://access.redhat.com/errata/RHSA-2023:6795 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Via RHSA-2023:6798 https://access.redhat.com/errata/RHSA-2023:6798 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2023:6811 https://access.redhat.com/errata/RHSA-2023:6811 |