Bug 2238898 (CVE-2023-41915)

Summary:	CVE-2023-41915 pmix: race condition allows attackers to obtain ownership of arbitrary files
Product:	[Other] Security Response	Reporter:	ybuenos
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	woodard
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	PMIx 4.2.6, PMIx 5.0.1	Doc Type:	If docs needed, set a value
Doc Text:	OpenPMIx PMIx is vulnerable to a race condition during execution of library code with UID 0, which allows attackers to obtain ownership of arbitrary files.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2239124, 2239125
Bug Blocks:	2238897

Description ybuenos 2023-09-14 07:58:40 UTC

OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.

https://docs.openpmix.org/en/latest/security.html
https://github.com/openpmix/openpmix/releases/tag/v5.0.1
https://github.com/openpmix/openpmix/releases/tag/v4.2.6

Comment 3 Dhananjay Arunesh 2023-09-15 11:21:24 UTC

Created pmix tracking bugs for this issue:

Affects: epel-7 [bug 2239125]
Affects: fedora-all [bug 2239124]

Comment 4 errata-xmlrpc 2024-04-30 09:47:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2199 https://access.redhat.com/errata/RHSA-2024:2199

Comment 5 errata-xmlrpc 2024-05-22 09:34:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:3008 https://access.redhat.com/errata/RHSA-2024:3008