Bug 2228622 (CVE-2023-35390)

Summary:	CVE-2023-35390 dotnet: RCE under dotnet commands
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	andrew.slice, bodavis, dbhole, kanderso, lvaleeva, omajid, rwagner, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	.NET SDK 6.0.121, .NET SDK 7.0.110, .NET Runtime 6.0.21, .NET Runtime 7.0.10	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in dotnet. This issue exists when some dotnet commands are used in directories with weaker permissions, which can result in remote code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-08-14 19:20:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2228877, 2228878, 2228879, 2228880, 2228881, 2228899, 2228900, 2228901, 2228902, 2228903, 2230088, 2230089, 2231098, 2231099
Bug Blocks:	2228616

Description Patrick Del Bello 2023-08-02 20:55:34 UTC

Remote Code Execution: When running some dotnet commands(e.g. dotnet help add), dotnet attempts to locate and initiate a new process using cmd.exe. However, it prioritizes searching for cmd.exe in the current working directory (CWD) before checking other locations. This can potentially lead to the execution of malicious code;

Comment 4 Sandipan Roy 2023-08-08 17:19:01 UTC

Created dotnet6.0 tracking bugs for this issue:

Affects: fedora-all [bug 2230089]


Created dotnet7.0 tracking bugs for this issue:

Affects: fedora-all [bug 2230088]

Comment 6 TEJ RATHI 2023-08-10 16:00:59 UTC

External References:
https://devblogs.microsoft.com/dotnet/august-2023-updates/
https://github.com/advisories/GHSA-p8rx-fwgq-rh2f
https://github.com/dotnet/announcements/issues/266
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35390

Comment 7 errata-xmlrpc 2023-08-14 14:32:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:4639 https://access.redhat.com/errata/RHSA-2023:4639

Comment 8 errata-xmlrpc 2023-08-14 14:40:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:4640 https://access.redhat.com/errata/RHSA-2023:4640

Comment 9 errata-xmlrpc 2023-08-14 14:44:21 UTC

This issue has been addressed in the following products:

  .NET Core on Red Hat Enterprise Linux

Via RHSA-2023:4641 https://access.redhat.com/errata/RHSA-2023:4641

Comment 10 errata-xmlrpc 2023-08-14 14:46:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4642 https://access.redhat.com/errata/RHSA-2023:4642

Comment 11 errata-xmlrpc 2023-08-14 14:46:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4644 https://access.redhat.com/errata/RHSA-2023:4644

Comment 12 errata-xmlrpc 2023-08-14 14:55:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4645 https://access.redhat.com/errata/RHSA-2023:4645

Comment 13 errata-xmlrpc 2023-08-14 14:55:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4643 https://access.redhat.com/errata/RHSA-2023:4643

Comment 14 Product Security DevOps Team 2023-08-14 19:20:38 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-35390