Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

CVE-2023-3899

Summary

A vulnerability exists in Subscription Manager that permits local privilege escalation due to insufficient authorization controls. The D-Bus interface com.redhat.RHSM1 grants access to numerous methods for all users, enabling a low-privileged local user to manipulate the state of the registration. Particularly, the com.redhat.RHSM1.Config.SetAll() method allows unauthorized users to unregister the system or alter current entitlements. This can lead to setting arbitrary configurations in /etc/rhsm/rhsm.conf, which can be exploited for a local privilege escalation to gain unconfined root access.

References