CVE-2023-3899 Missing authorization in Red Hat Enterprise Linux 6
Local attackers can exploit inadequate D-Bus authorization in subscription-manager to modify configuration and escalate privileges to root.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-3899?
CVE-2023-3899 is a high-severity missing authorization vulnerability in Fedoraproject Fedora, published on 23 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
Which versions are affected by CVE-2023-3899?
It affects 20 products.
Linux distribution packages (40)
dnf-plugin-subscription-manager AlmaLinux:8 | All versions | 1.28.36-3.el8_8.alma.1 |
python3-cloud-what AlmaLinux:8 | All versions | 1.28.36-3.el8_8.alma.1 |
python3-subscription-manager-rhsm AlmaLinux:8 | All versions | 1.28.36-3.el8_8.alma.1 |
python3-syspurpose AlmaLinux:8 | All versions | 1.28.36-3.el8_8.alma.1 |
subscription-manager AlmaLinux:8 | All versions | 1.28.36-3.el8_8.alma.1 |
subscription-manager-migration AlmaLinux:8 | All versions | 1.28.36-3.el8_8.alma.1 |
subscription-manager-plugin-ostree AlmaLinux:8 | All versions | 1.28.36-3.el8_8.alma.1 |
subscription-manager-rhsm-certificates AlmaLinux:8 | All versions | 1.28.36-3.el8_8.alma.1 |
libdnf-plugin-subscription-manager AlmaLinux:9 | All versions | 1.29.33.1-2.el9_2.alma.1 |
python3-cloud-what AlmaLinux:9 | All versions | 1.29.33.1-2.el9_2.alma.1 |
python3-subscription-manager-rhsm AlmaLinux:9 | All versions | 1.29.33.1-2.el9_2.alma.1 |
subscription-manager AlmaLinux:9 | All versions | 1.29.33.1-2.el9_2.alma.1 |
subscription-manager-plugin-ostree AlmaLinux:9 | All versions | 1.29.33.1-2.el9_2.alma.1 |
python-syspurpose Red Hat:enterprise_linux:7::client | All versions | 0:1.24.52-2.el7_9 |
rhsm-gtk Red Hat:enterprise_linux:7::client | All versions | 0:1.24.52-2.el7_9 |
subscription-manager Red Hat:enterprise_linux:7::client | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-cockpit Red Hat:enterprise_linux:7::client | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-gui Red Hat:enterprise_linux:7::client | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-initial-setup-addon Red Hat:enterprise_linux:7::client | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-migration Red Hat:enterprise_linux:7::client | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-plugin-container Red Hat:enterprise_linux:7::client | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-plugin-ostree Red Hat:enterprise_linux:7::client | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-rhsm Red Hat:enterprise_linux:7::client | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-rhsm-certificates Red Hat:enterprise_linux:7::client | All versions | 0:1.24.52-2.el7_9 |
rhsm-gtk Red Hat:enterprise_linux:7::computenode | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-cockpit Red Hat:enterprise_linux:7::computenode | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-gui Red Hat:enterprise_linux:7::computenode | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-initial-setup-addon Red Hat:enterprise_linux:7::computenode | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-plugin-ostree Red Hat:enterprise_linux:7::computenode | All versions | 0:1.24.52-2.el7_9 |
python-syspurpose Red Hat:enterprise_linux:7::server | All versions | 0:1.24.52-2.el7_9 |
rhsm-gtk Red Hat:enterprise_linux:7::server | All versions | 0:1.24.52-2.el7_9 |
subscription-manager Red Hat:enterprise_linux:7::server | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-cockpit Red Hat:enterprise_linux:7::server | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-gui Red Hat:enterprise_linux:7::server | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-initial-setup-addon Red Hat:enterprise_linux:7::server | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-migration Red Hat:enterprise_linux:7::server | All versions | 0:1.24.52-2.el7_9 |
subscription-manager-plugin-container Red Hat:enterprise_linux:7::server | All versions | 0:1.24.52-2.el7_9 |
Products include Fedoraproject Fedora, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux for Arm 64, Redhat Enterprise Linux for Arm 64 Eus and 14 more.
How do I fix CVE-2023-3899?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-3899 being exploited?
There is no known exploitation of CVE-2023-3899 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALSA-2023:4706, ALSA-2023:4708, AZL-28099, AZL-37046, GHSA-wp8h-m67c-cxpw, RHSA-2023:4701 and 9 more.