SUSE update for pmix
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2023-41915 |
| CWE-ID | CWE-362 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
HPC Module Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system pmix-mca-params Operating systems & Components / Operating system package or component pmix-headers Operating systems & Components / Operating system package or component pmix-devel Operating systems & Components / Operating system package or component pmix-debugsource Operating systems & Components / Operating system package or component pmix-debuginfo Operating systems & Components / Operating system package or component libmca_common_dstore1 Operating systems & Components / Operating system package or component libpmix2 Operating systems & Components / Operating system package or component pmix-test Operating systems & Components / Operating system package or component pmix-plugin-munge-debuginfo Operating systems & Components / Operating system package or component libmca_common_dstore1-debuginfo Operating systems & Components / Operating system package or component pmix-plugins-debuginfo Operating systems & Components / Operating system package or component pmix-test-debuginfo Operating systems & Components / Operating system package or component pmix-plugin-munge Operating systems & Components / Operating system package or component pmix-plugins Operating systems & Components / Operating system package or component pmix Operating systems & Components / Operating system package or component libpmix2-debuginfo Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Race condition
EUVDB-ID: #VU80882
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-41915
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition when the PMIx library called is called by a process
running as uid 0. A local user can exploit the race and obtain ownership of an arbitrary file on the filesystem.
Update the affected package pmix to the latest version.
Vulnerable software versionsHPC Module: 15-SP4 - 15-SP5
SUSE Linux Enterprise High Performance Computing 15: SP4 - SP5
openSUSE Leap: 15.4 - 15.5
pmix-mca-params: before 3.2.3-150300.3.8.1
pmix-headers: before 3.2.3-150300.3.8.1
pmix-devel: before 3.2.3-150300.3.8.1
pmix-debugsource: before 3.2.3-150300.3.8.1
pmix-debuginfo: before 3.2.3-150300.3.8.1
libmca_common_dstore1: before 3.2.3-150300.3.8.1
libpmix2: before 3.2.3-150300.3.8.1
pmix-test: before 3.2.3-150300.3.8.1
pmix-plugin-munge-debuginfo: before 3.2.3-150300.3.8.1
libmca_common_dstore1-debuginfo: before 3.2.3-150300.3.8.1
pmix-plugins-debuginfo: before 3.2.3-150300.3.8.1
pmix-test-debuginfo: before 3.2.3-150300.3.8.1
pmix-plugin-munge: before 3.2.3-150300.3.8.1
pmix-plugins: before 3.2.3-150300.3.8.1
pmix: before 3.2.3-150300.3.8.1
libpmix2-debuginfo: before 3.2.3-150300.3.8.1
CPE2.3- cpe:2.3:o:suse:hpc_module:15-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:hpc_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.5:*:*:*:*:*:*:*
- cpe:2.3:a:suse:pmix-mca-params:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:pmix-headers:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:pmix-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:pmix-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:pmix-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libmca_common_dstore1:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpmix2:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:pmix-test:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:pmix-plugin-munge-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libmca_common_dstore1-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:pmix-plugins-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:pmix-test-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:pmix-plugin-munge:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:pmix-plugins:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:pmix:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libpmix2-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2023/suse-su-20233859-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
