Description
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | python3-cloud-what +4 | 1.29.33.1-2.el9_2 | RHSA-2023:4708 |
| RHEL 8 | rhsm-gtk +11 | 1.28.36-3.el8_8 | RHSA-2023:4706 |
| RHEL 7 | rhsm-gtk +10 | 1.24.52-2.el7_9 | RHSA-2023:4701 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.0 EUS | rhsm-icons +7 | 1.29.26.2-2.el9_0 | RHSA-2023:4707 |
| RHEL 8.6 EUS | rhsm-gtk +11 | 1.28.29.1-2.el8_6 | RHSA-2023:4705 |
| RHEL 8.4 TUS | rhsm-gtk +10 | 1.28.13-7.el8_4 | RHSA-2023:4704 |
| RHEL 8.4 E4S | rhsm-gtk +10 | 1.28.13-7.el8_4 | RHSA-2023:4704 |
| RHEL 8.4 AUS | rhsm-gtk +10 | 1.28.13-7.el8_4 | RHSA-2023:4704 |
| RHEL 8.2 TUS | rhsm-gtk +10 | 1.26.22-2.el8_2 | RHSA-2023:4703 |
| RHEL 8.2 E4S | rhsm-gtk +10 | 1.26.22-2.el8_2 | RHSA-2023:4703 |
| RHEL 8.2 AUS | rhsm-gtk +10 | 1.26.22-2.el8_2 | RHSA-2023:4703 |
| RHEL 8.1 E4S | rhsm-gtk +10 | 1.25.17.1-2.el8_1 | RHSA-2023:4702 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | python3-cloud-what +4 | 1.29.33.1-2.el9_2.alma.1 | ALSA-2023:4708 |
| AlmaLinux 8 | python3-cloud-what +7 | 1.28.36-3.el8_8.alma.1 | ALSA-2023:4706 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | subscription-manager | 1.29.33.1-2.el9_2.rocky.0.1 | RLSA-2023:4708 |
| Rocky Linux 8 | subscription-manager | 1.28.36-3.el8_8.rocky.0.1 | RLSA-2023:4706 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | subscription-manager | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | subscription-manager | No fix yet | — |
Advisories 14
- ALSA-2023:4708 Important: subscription-manager security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:4706 Important: subscription-manager security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2023:4704 Red Hat Security Advisory: subscription-manager security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2023:4706 Red Hat Security Advisory: subscription-manager security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2023:4703 Red Hat Security Advisory: subscription-manager security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2023:4702 Red Hat Security Advisory: subscription-manager security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2023:4701 Red Hat Security Advisory: subscription-manager security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2023:4705 Red Hat Security Advisory: subscription-manager security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RLSA-2023:4708 Important: subscription-manager security update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2023:4706 Important: subscription-manager security update Rocky Linux Security Advisories · Feb 4, 2026
- RHSA-2023:4707 Red Hat Security Advisory: subscription-manager security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2023:4708 Red Hat Security Advisory: subscription-manager security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- WID-SEC-2023-2118 Red Hat Enterprise Linux (subscription-manager): Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Jan 1, 2024
- WID-SEC-2023-2902 IBM Security Guardium: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 14, 2023
References
- RHSA-2023:4701 vendor-advisory
- RHSA-2023:4702 vendor-advisory
- RHSA-2023:4703 vendor-advisory
- RHSA-2023:4704 vendor-advisory
- RHSA-2023:4705 vendor-advisory
- RHSA-2023:4706 vendor-advisory
- RHSA-2023:4707 vendor-advisory
- RHSA-2023:4708 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-3899 vdb-entry
- RHBZ#2225407 issue-tracking