CVE-2023-3899 Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
Problem types: cwe_id: CWE-285
description: Improper Authorization
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7::workstation
cpe:/o:redhat:enterprise_linux:7::server
cpe:/o:redhat:enterprise_linux:7::client
cpe:/o:redhat:enterprise_linux:7::computenode
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/o:redhat:enterprise_linux:8::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/o:redhat:enterprise_linux:8::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:8.1::appstream
cpe:/o:redhat:rhel_e4s:8.1::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.2 Advanced Update Support
cpes: cpe:/a:redhat:rhel_e4s:8.2::appstream
cpe:/o:redhat:rhel_aus:8.2::baseos
cpe:/a:redhat:rhel_tus:8.2::appstream
cpe:/o:redhat:rhel_e4s:8.2::baseos
cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/o:redhat:rhel_tus:8.2::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.2 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_e4s:8.2::appstream
cpe:/o:redhat:rhel_aus:8.2::baseos
cpe:/a:redhat:rhel_tus:8.2::appstream
cpe:/o:redhat:rhel_e4s:8.2::baseos
cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/o:redhat:rhel_tus:8.2::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:8.2::appstream
cpe:/o:redhat:rhel_aus:8.2::baseos
cpe:/a:redhat:rhel_tus:8.2::appstream
cpe:/o:redhat:rhel_e4s:8.2::baseos
cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/o:redhat:rhel_tus:8.2::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
cpes: cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
cpe:/o:redhat:rhel_tus:8.4::baseos
cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/o:redhat:rhel_aus:8.4::baseos
cpe:/o:redhat:rhel_e4s:8.4::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Telecommunications Update Service
cpes: cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
cpe:/o:redhat:rhel_tus:8.4::baseos
cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/o:redhat:rhel_aus:8.4::baseos
cpe:/o:redhat:rhel_e4s:8.4::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
cpe:/o:redhat:rhel_tus:8.4::baseos
cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/o:redhat:rhel_aus:8.4::baseos
cpe:/o:redhat:rhel_e4s:8.4::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Extended Update Support
cpes: cpe:/o:redhat:rhel_eus:8.6::baseos
cpe:/a:redhat:rhel_eus:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Extended Update Support
cpes: cpe:/o:redhat:rhel_eus:9.0::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This issue was discovered by Thibault Guittet (Senior Product Security Engineer, Red Hat).
Published: 2023-08-23T10:49:11.684Z