CVE-2023-1672 Race condition exists in the key generation and rotation functionality

Medium 5.3 Published 11 Jul 2023 Updated 13 Feb 2025

A race condition in Tang server key generation allows local processes to read private keys during a small time window.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-1672?

CVE-2023-1672 is a medium-severity vulnerability in Fedoraproject Fedora, published on 11 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host.

Weakness: CWE-362

Which versions are affected by CVE-2023-1672?

It affects 3 products.

Linux distribution packages (8)

`tang` AlmaLinux:8	All versions	`7-8.el8`
`tang` AlmaLinux:9	All versions	`14-2.el9`
`tang` Red Hat:enterprise_linux:8::appstream	All versions	`0:7-8.el8`
`tang-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:7-8.el8`
`tang-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:7-8.el8`
`tang` Red Hat:enterprise_linux:9::appstream	All versions	`0:14-2.el9`
`tang-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:14-2.el9`
`tang-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:14-2.el9`

Products include Fedoraproject Fedora, Redhat Enterprise Linux, Tang Project Tang.

How do I fix CVE-2023-1672?

Apply the vendor's patch.

Is CVE-2023-1672 being exploited?

There is no known exploitation of CVE-2023-1672 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as ALSA-2023:6492, ALSA-2023:7022, AZL-27405, DEBIAN-CVE-2023-1672, DLA-3648-1, GHSA-9wgp-4vcq-75qr and 5 more.