REDHAT-BUG-2556057: Medium severity Red Hat cockpit-machines vulnerability
A flaw was found in cockpit-machines. The getRhelImageUrl() and downloadRhelImage() functions pass a Red Hat Subscription Management (RHSM) access token to Python helpers in JSON command-line arguments. When another user initiates an RHSM-backed image retrieval workflow, a local unprivileged attacker on a host permitting cross-user process inspection can read the token from the helper's command line. For system connections, the download helper requires elevated execution, and the token remains in its arguments while an image transfer is running. Disclosure of the bearer token may allow unauthorized access to RHSM resources within the token's permissions and validity period.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to token disclosure?
Systems are exposed when a user starts an RHSM-backed image retrieval workflow and the host allows one unprivileged user to inspect another user's process command lines. System connections have additional exposure because the elevated download helper retains the token in its arguments during image transfer.
What must an attacker be able to do to obtain the token?
The attacker needs local unprivileged access to the same host and must be able to inspect the command line of the Python helper process while the RHSM-backed image retrieval or transfer is running. The token is supplied to the helper as a JSON command-line argument.
What could an attacker do with a disclosed token?
A disclosed bearer token may permit unauthorized access to RHSM resources, limited by the token's assigned permissions and remaining validity period.