CVE-2023-3899: Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
Other sources
Red Hat Enterprise Linux could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper authorization by the subscription-manager. By sending a specially crafted request through D-Bus interface com.redhat.RHSM1, an authenticated attacker could exploit this vulnerability to gain elevated privileges to an unconfined root.
— IBM
The DBus interface com.redhat.RHSM1 exposes a significant number of methods to all users that will change the state of the registration. A non-privileged user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. By using the com.redhat.RHSM1.Config.SetAll() method, an unprivileged user can perform a local privilege escalation to unconfined root.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/subscription-managerto a version that resolves this vulnerability.Fixed in 1.29.37 - Upgrade
Upgrade
redhat/subscription-managerto a version that resolves this vulnerability.Fixed in 1.28.36