-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Create Advisory-SVG-CVE-2023-1829.md
- Loading branch information
1 parent
b0d4bd7
commit 62bca2c
Showing
1 changed file
with
172 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,172 @@ | ||
--- | ||
title: Advisory-SVG-CVE-2023-1829 | ||
permalink: /Advisory-SVG-CVE-2023-1829 | ||
redirect_from: | ||
- /Advisory-SVG-CVE-2023-1821 | ||
- /Advisory-SVG-CVE-2023-2235 | ||
- /Advisory-SVG-CVE-2023-2124 | ||
|
||
published: false | ||
--- | ||
|
||
## Advisory-SVG-CVE-2023-1829 | ||
|
||
``` | ||
Title: EGI SVG 'ADVISORY' [TLP:WHITE] Up to CRITICAL risk | ||
Linux kernel vulnerabilities [EGI-SVG-CVE-2023-1829] | ||
Date: 2023-08-10 | ||
Updated: 2023-09-15 | ||
Affected software and risk | ||
========================== | ||
Up to CRITICAL risk vulnerabilities concerning the Linux kernel | ||
Package : Linux kernel - affecting RHEL8 and RHEL7:-- | ||
CVE ID : CVE-2023-1829 CVSS score 7.4 [R 2] | ||
CVE ID : CVE-2023-1281 CVSS score 7.8 [R 1] | ||
These have the potential for local privilege escalation | ||
Package : Linux kernel - affecting RHEL8 and RHEL9:-- | ||
CVE-ID : CVE-2023-2235 CVSS score 7.8 [R 3] | ||
In cases where RH7 is affected RedHat has said they will NOT fix and | ||
mitigation is thus advised instead. | ||
Note that we consider these at least high risk | ||
Actions required/recommended | ||
============================ | ||
Sites are recommended to update relevant components as soon as possible | ||
if updates are available for the distribution they install. | ||
Note that RedHat is stating it will NOT provide updates for RH7. | ||
For sites who cannot update, we recommend mitigation where possible. | ||
Component installation information | ||
================================== | ||
Sites running RHEL should see [R 1], [R 2], [R 3], [R 4] | ||
Sites running CentOS should also see [R 1], [R 2], [R 3], [R 4], [R 5] | ||
Sites running Debian should see [R 6] and similar links | ||
Sites running Ubuntu should see [R 7] and similar links | ||
Sites running RockyLinux should see [R 8] | ||
Sites running Almalinux should see [R 9] | ||
Mitigation | ||
========== | ||
For CVE-2023-1281 and CVE-2023-1829 RedHat recommends disabling | ||
module cls_tcindex as mitigation [R 1] | ||
The recommendations on Linux namespaces and containers in [R 10] | ||
may be followed to mitigate both CVE-2023-1281 and CVE-2023-1829. | ||
More information | ||
================ | ||
One group has claimed to to produce an exploit for CVE-2023-1829 is | ||
available at [R 11], for this reason we consider this vulnerability | ||
as potentially CRITICAL risk. However, this vulnerability does NOT | ||
affect RHEL9. Hence, for RHEL8 and RHEL7 this vulnerability MAY | ||
be critical, if the exploit works. (SVG has not tested it.) | ||
Another relevant CVE is CVE-2023-2124 [R 4] CVSS score 7.0, which | ||
affects RHEL7, RHEL8, and RHEL9. RedHat states as 'Moderate'. | ||
There is the potential for Privilege escalation. By updating for | ||
the previous vulnerabilities sites will have updated for this. | ||
This advisory does cover multiple CVE's, with different Risks. | ||
All these vulnerabilities are fixed via the same kernel release, | ||
therefore we (the EGI SVG) thought it appropriate to issue one | ||
advisory covering them all. | ||
Hence this advisory is considered to be related to HIGH risk | ||
vulnerabilities, plus a potentially CRITICAL one for RHEL7 and RHEL8. | ||
Those vulnerabilities which affect RH7 are unlikely to be fixed for | ||
Scientific Linux as Scientific Linux depends on RHEL7 | ||
TLP and URL | ||
=========== | ||
** WHITE information - Unlimited distribution | ||
- see https://go.egi.eu/tlp for | ||
distribution restrictions ** | ||
URL: https://advisories.egi.eu/Advisory-SVG-CVE-2023-1829 | ||
Minor updates may be made without re-distribution to the sites | ||
Comments | ||
======== | ||
Comments or questions should be sent to svg-rat at mailman.egi.eu | ||
If you find or become aware of another vulnerability which is relevant to EGI | ||
you may report it by e-mail to | ||
report-vulnerability at egi.eu | ||
the EGI Software Vulnerability Group will take a look according to the | ||
procedure defined in [R 99] | ||
References | ||
========== | ||
[R 1] https://access.redhat.com/security/cve/CVE-2023-1281 | ||
[R 2] https://access.redhat.com/security/cve/CVE-2023-1829 | ||
[R 3] https://access.redhat.com/security/cve/CVE-2023-2235 | ||
[R 4] https://access.redhat.com/security/cve/CVE-2023-2124 | ||
[R 5] https://lists.centos.org/pipermail/centos-announce/ | ||
[R 6] https://security-tracker.debian.org/tracker/CVE-2023-1281 | ||
[R 7] https://ubuntu.com/security/CVE-2023-1281 | ||
[R 8] https://errata.build.resf.org/ | ||
[R 9] https://errata.almalinux.org/ | ||
[R 10] https://csirt.egi.eu/2022/10/19/linux-namespaces-and-containers/ | ||
[R 11] https://starlabs.sg/blog/2023/06-breaking-the-code-exploiting-and-examining-cve-2023-1829-in-cls_tcindex-classifier-vulnerability/ | ||
[R 99] https://documents.egi.eu/public/ShowDocument?docid=3867 | ||
Credit | ||
====== | ||
SVG was alerted to these vulnerabilities by Mischa Salle | ||
Context | ||
======= | ||
This advisory has been prepared as part of the effort to fulfil EGI SVG's | ||
purpose "To minimize the risk to the EGI infrastructure arising from software | ||
vulnerabilities" | ||
The risk is that assessed by the group, according to the EGI SVG issue handling | ||
procedure [R 99] in the context of how the software is used in the EGI | ||
infrastructure. It is the opinion of the group, we do not guarantee it to be | ||
correct. The risk may also be higher or lower in other deployments depending on | ||
how the software is used. | ||
----------------------------- | ||
This advisory is subject to the Creative commons licence | ||
https://creativecommons.org/licenses/by/4.0/ | ||
and the EGI https://www.egi.eu/ Software Vulnerability Group must be credited. | ||
----------------------------- | ||
On behalf of the EGI SVG, | ||
``` |