Create Advisory-SVG-CVE-2023-1829.md

2023/Advisory-SVG-CVE-2023-1829.md

@@ -0,0 +1,172 @@
+---
+title: Advisory-SVG-CVE-2023-1829
+permalink: /Advisory-SVG-CVE-2023-1829
+redirect_from:
+  - /Advisory-SVG-CVE-2023-1821
+  - /Advisory-SVG-CVE-2023-2235
+  - /Advisory-SVG-CVE-2023-2124
+
+published: false
+---
+
+## Advisory-SVG-CVE-2023-1829
+
+```
+Title:   EGI SVG 'ADVISORY' [TLP:WHITE]  Up to CRITICAL risk
+          Linux kernel vulnerabilities [EGI-SVG-CVE-2023-1829]
+
+Date:    2023-08-10
+Updated: 2023-09-15
+
+Affected software and risk
+==========================
+Up to CRITICAL risk vulnerabilities concerning the Linux kernel 
+
+Package    : Linux kernel - affecting RHEL8 and RHEL7:--
+
+CVE ID     : CVE-2023-1829  CVSS score 7.4 [R 2]
+CVE ID     : CVE-2023-1281  CVSS score 7.8 [R 1]
+
+These have the potential for local privilege escalation
+
+Package    : Linux kernel - affecting RHEL8 and RHEL9:--
+
+CVE-ID     : CVE-2023-2235  CVSS score 7.8 [R 3]
+
+In cases where RH7 is affected RedHat has said they will NOT fix and
+mitigation is thus advised instead.
+
+Note that we consider these at least high risk
+
+Actions required/recommended
+============================
+
+Sites are recommended to update relevant components as soon as possible
+if updates are available for the distribution they install.
+
+Note that RedHat is stating it will NOT provide updates for RH7.
+
+For sites who cannot update, we recommend mitigation where possible.
+
+Component installation information
+==================================
+
+Sites running RHEL should see [R 1], [R 2], [R 3], [R 4]
+
+Sites running CentOS should also see [R 1], [R 2], [R 3], [R 4], [R 5]
+
+Sites running Debian should see [R 6] and similar links
+
+Sites running Ubuntu should see [R 7] and similar links
+
+Sites running RockyLinux should see [R 8] 
+
+Sites running Almalinux should see [R 9]
+
+Mitigation
+==========
+
+For CVE-2023-1281 and CVE-2023-1829 RedHat recommends disabling
+module cls_tcindex as mitigation [R 1] 
+
+The recommendations on Linux namespaces and containers in [R 10]
+may be followed to mitigate both CVE-2023-1281 and CVE-2023-1829.
+
+More information
+================
+
+One group has claimed to to produce an exploit for CVE-2023-1829 is
+available at [R 11], for this reason we consider this vulnerability
+as potentially CRITICAL risk.  However, this vulnerability does NOT
+affect RHEL9. Hence, for RHEL8 and RHEL7 this vulnerability MAY
+be critical, if the exploit works. (SVG has not tested it.) 
+
+Another relevant CVE is CVE-2023-2124  [R 4] CVSS score 7.0, which
+affects RHEL7, RHEL8, and RHEL9.  RedHat states as 'Moderate'.
+There is the potential for Privilege escalation.  By updating for
+the previous vulnerabilities sites will have updated for this. 
+
+This advisory does cover multiple CVE's, with different Risks.
+All these vulnerabilities are fixed via the same kernel release,
+therefore we (the EGI SVG) thought it appropriate to issue one
+advisory covering them all.
+Hence this advisory is considered to be related to HIGH risk
+vulnerabilities, plus a potentially CRITICAL one for RHEL7 and RHEL8.
+    
+Those vulnerabilities which affect RH7 are unlikely to be fixed for
+Scientific Linux as Scientific Linux depends on RHEL7 
+
+TLP and URL
+===========
+
+** WHITE information - Unlimited distribution
+ - see https://go.egi.eu/tlp for
+   distribution restrictions **
+   
+URL: https://advisories.egi.eu/Advisory-SVG-CVE-2023-1829
+Minor updates may be made without re-distribution to the sites
+
+Comments
+========
+
+Comments or questions should be sent to svg-rat  at  mailman.egi.eu
+If you find or become aware of another vulnerability which is relevant to EGI
+you may report it by e-mail to
+
+report-vulnerability at egi.eu
+
+the EGI Software Vulnerability Group will take a look according to the
+procedure defined in [R 99]
+
+References
+==========
+[R 1] https://access.redhat.com/security/cve/CVE-2023-1281
+    
+[R 2] https://access.redhat.com/security/cve/CVE-2023-1829
+    
+[R 3] https://access.redhat.com/security/cve/CVE-2023-2235
+    
+[R 4] https://access.redhat.com/security/cve/CVE-2023-2124 
+    
+[R 5] https://lists.centos.org/pipermail/centos-announce/
+    
+[R 6] https://security-tracker.debian.org/tracker/CVE-2023-1281
+
+[R 7] https://ubuntu.com/security/CVE-2023-1281
+
+[R 8] https://errata.build.resf.org/ 
+
+[R 9] https://errata.almalinux.org/ 
+
+[R 10] https://csirt.egi.eu/2022/10/19/linux-namespaces-and-containers/
+
+[R 11] https://starlabs.sg/blog/2023/06-breaking-the-code-exploiting-and-examining-cve-2023-1829-in-cls_tcindex-classifier-vulnerability/
+
+[R 99] https://documents.egi.eu/public/ShowDocument?docid=3867
+
+Credit
+======
+
+SVG was alerted to these vulnerabilities by Mischa Salle 
+
+Context
+=======
+
+This advisory has been prepared as part of the effort to fulfil EGI SVG's
+purpose "To minimize the risk to the EGI infrastructure arising from software
+vulnerabilities"
+The risk is that assessed by the group, according to the EGI SVG issue handling
+procedure [R 99] in the context of how the software is used in the EGI
+infrastructure. It is the opinion of the group, we do not guarantee it to be
+correct. The risk may also be higher or lower in other deployments depending on
+how the software is used.
+
+-----------------------------
+This advisory is subject to the Creative commons licence 
+https://creativecommons.org/licenses/by/4.0/ 
+and the EGI https://www.egi.eu/ Software Vulnerability Group must be credited. 
+-----------------------------
+
+
+On behalf of the EGI SVG,
+```