Tracker-miners: sandbox escape
CVE-2023-5557

7.7HIGH

Key Information:

Vendor
Red Hat
Status
tracker-miners
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 8.2 Advanced Update Support
Red Hat Enterprise Linux 8.2 Telecommunications Update Service
Vendor
CVE Published:
13 October 2023

Summary

A flaw in the Tracker-miners package exposes a security weakness within its sandbox environment. This vulnerability allows an attacker to execute arbitrary code outside the sandbox if the tracker-extract process has already been compromised through another vulnerability, potentially leading to a severe breach of system integrity.

Affected Version(s)

Red Hat Enterprise Linux 8 0:2.1.5-2.el8_9.1

Red Hat Enterprise Linux 8.2 Advanced Update Support 0:2.1.5-2.el8_2.1

Red Hat Enterprise Linux 8.2 Telecommunications Update Service 0:2.1.5-2.el8_2.1

References

https://access.redhat.com/errata/RHSA-2023:7712
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7713
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7730
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.