CVE-2023-3899: Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

Red Hat Enterprise Linux could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper authorization by the subscription-manager. By sending a specially crafted request through D-Bus interface com.redhat.RHSM1, an authenticated attacker could exploit this vulnerability to gain elevated privileges to an unconfined root.

— IBM

The DBus interface com.redhat.RHSM1 exposes a significant number of methods to all users that will change the state of the registration. A non-privileged user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. By using the com.redhat.RHSM1.Config.SetAll() method, an unprivileged user can perform a local privilege escalation to unconfined root.

— Red Hat