CVE-2023-41915 — Race Condition in Openpmix

CWE-362 — Race Condition8 documents8 sources
Severity
8.1HIGHNVD
EPSS
1.0%
top 23.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
OpenpmixDebian PmixDebian Linux+3 more
Timeline
PublishedSep 9
Latest updateOct 17

Description

OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages4 packages

▶NVDopenpmix/openpmix< 4.2.6+1
▶debiandebian/pmix< pmix 4.2.2-1+deb12u1 (bookworm)

Also affects: Debian Linux 10.0, 12.0, Fedora 37, 38, 39

🔴Vulnerability Details

2
GHSA
GHSA-m8fg-c37h-w29q: OpenPMIx PMIx before 4↗2023-09-10
▶
OSV
CVE-2023-41915: OpenPMIx PMIx before 4↗2023-09-09
▶

📋Vendor Advisories

5
Ubuntu
PMIx vulnerability↗2023-10-17
▶
Microsoft
OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.↗2023-09-12
▶
Red Hat
pmix: race condition allows attackers to obtain ownership of arbitrary files↗2023-09-10
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: Rest Services Manager (Netty) — CVE-2022-41915↗2023-07-15
▶
Debian
CVE-2023-41915: pmix - OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain own...↗2023
▶