CVE-2023-3899

Name of the Vulnerable Software and Affected Versions subscription-manager (affected versions not specified)

Description A flaw in the authorization procedure of the D-Bus interface com.redhat.RHSM1 allows local privilege escalation. The interface exposes several methods to all users, which can change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user can tamper with the registration state, potentially unregistering the system or changing current entitlements. This issue can be exploited to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, leading to local privilege escalation to an unconfined root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.