Vulnerability-Lookup

ubuntu-cve-2023-41915

Vulnerability from osv_ubuntu

Published

2023-09-09 22:15

Modified

2026-04-22 07:45

Summary

Details

OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.

Severity

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2023-41915	REPORT
	https://github.com/openpmix/openpmix/commit/da036…	REPORT
	https://github.com/openpmix/openpmix/commit/0bf98…	REPORT
	https://docs.openpmix.org/en/latest/security.html	REPORT
	https://github.com/openpmix/openpmix/releases/tag…	REPORT
	https://github.com/openpmix/openpmix/releases/tag…	REPORT
	https://ubuntu.com/security/notices/USN-6434-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2023-41915	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libpmi1-pmix",
            "binary_version": "2.1.1~rc1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libpmi2-pmix",
            "binary_version": "2.1.1~rc1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libpmix2",
            "binary_version": "2.1.1~rc1-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "pmix",
        "purl": "pkg:deb/ubuntu/pmix@2.1.1~rc1-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.1~rc1-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.0~rc1-1",
        "2.1.0~rc1-2",
        "2.1.0~rc1-3",
        "2.1.0-1",
        "2.1.0-2",
        "2.1.1~rc1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libpmix-bin",
            "binary_version": "4.1.2-2ubuntu1+esm1"
          },
          {
            "binary_name": "libpmix2",
            "binary_version": "4.1.2-2ubuntu1+esm1"
          },
          {
            "binary_name": "python3-pmix",
            "binary_version": "4.1.2-2ubuntu1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "pmix",
        "purl": "pkg:deb/ubuntu/pmix@4.1.2-2ubuntu1+esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.2-2ubuntu1+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.1.0-3ubuntu1",
        "4.1.0-3ubuntu2",
        "4.1.1~rc6-1ubuntu1",
        "4.1.2-2ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.",
  "id": "UBUNTU-CVE-2023-41915",
  "modified": "2026-04-22T07:45:26Z",
  "published": "2023-09-09T22:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-41915"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/openpmix/openpmix/commit/da036933c2795c1f40d0835e15f17e204e4daf0f"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/openpmix/openpmix/commit/0bf9801a3017eb6ca411e158da39570ccb998c17"
    },
    {
      "type": "REPORT",
      "url": "https://docs.openpmix.org/en/latest/security.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/openpmix/openpmix/releases/tag/v5.0.1"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/openpmix/openpmix/releases/tag/v4.2.6"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6434-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41915"
    }
  ],
  "related": [
    "USN-6434-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2023-41915"
  ]
}

CVE-2023-41915 (GCVE-0-2023-41915)

Vulnerability from cvelistv5 – Published: 2023-09-09 00:00 – Updated: 2024-08-02 19:09

Summary

OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

12 references

URL	Tags
https://docs.openpmix.org/en/latest/security.html
https://github.com/openpmix/openpmix/releases/tag…
https://github.com/openpmix/openpmix/releases/tag…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://www.debian.org/security/2023/dsa-5547	vendor-advisory
http://www.openwall.com/lists/oss-security/2024/07/10/3	mailing-list
http://www.openwall.com/lists/oss-security/2024/07/10/4	mailing-list
http://www.openwall.com/lists/oss-security/2024/07/10/6	mailing-list
http://www.openwall.com/lists/oss-security/2024/07/11/3	mailing-list

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:09:49.401Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://docs.openpmix.org/en/latest/security.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openpmix/openpmix/releases/tag/v5.0.1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openpmix/openpmix/releases/tag/v4.2.6"
          },
          {
            "name": "FEDORA-2023-1185eca900",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFKIY6SNC3KQNZMVROWMIW6DI5XPNKQX/"
          },
          {
            "name": "FEDORA-2023-d6dbdf62ad",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYJ7IRNR6NHJMTNOV3E3W3D5MLDRDCJX/"
          },
          {
            "name": "FEDORA-2023-155d2f22f1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDLWSMQYXF2ZGOQKCG26H6ZZA5FEH7HX/"
          },
          {
            "name": "[debian-lts-announce] 20231031 [SECURITY] [DLA 3643-1] pmix security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00048.html"
          },
          {
            "name": "DSA-5547",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5547"
          },
          {
            "name": "[oss-security] 20240710 linux-distros application for CentOS Project\u0027s Hyperscale SIG",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/07/10/3"
          },
          {
            "name": "[oss-security] 20240710 Re: linux-distros application for CentOS Project\u0027s Hyperscale SIG",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/07/10/4"
          },
          {
            "name": "[oss-security] 20240710 Re: linux-distros application for CentOS Project\u0027s Hyperscale SIG",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/07/10/6"
          },
          {
            "name": "[oss-security] 20240710 Re: linux-distros application for CentOS Project\u0027s Hyperscale SIG",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/07/11/3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-11T14:06:02.353Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://docs.openpmix.org/en/latest/security.html"
        },
        {
          "url": "https://github.com/openpmix/openpmix/releases/tag/v5.0.1"
        },
        {
          "url": "https://github.com/openpmix/openpmix/releases/tag/v4.2.6"
        },
        {
          "name": "FEDORA-2023-1185eca900",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFKIY6SNC3KQNZMVROWMIW6DI5XPNKQX/"
        },
        {
          "name": "FEDORA-2023-d6dbdf62ad",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYJ7IRNR6NHJMTNOV3E3W3D5MLDRDCJX/"
        },
        {
          "name": "FEDORA-2023-155d2f22f1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDLWSMQYXF2ZGOQKCG26H6ZZA5FEH7HX/"
        },
        {
          "name": "[debian-lts-announce] 20231031 [SECURITY] [DLA 3643-1] pmix security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00048.html"
        },
        {
          "name": "DSA-5547",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5547"
        },
        {
          "name": "[oss-security] 20240710 linux-distros application for CentOS Project\u0027s Hyperscale SIG",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2024/07/10/3"
        },
        {
          "name": "[oss-security] 20240710 Re: linux-distros application for CentOS Project\u0027s Hyperscale SIG",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2024/07/10/4"
        },
        {
          "name": "[oss-security] 20240710 Re: linux-distros application for CentOS Project\u0027s Hyperscale SIG",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2024/07/10/6"
        },
        {
          "name": "[oss-security] 20240710 Re: linux-distros application for CentOS Project\u0027s Hyperscale SIG",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2024/07/11/3"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-41915",
    "datePublished": "2023-09-09T00:00:00.000Z",
    "dateReserved": "2023-09-05T00:00:00.000Z",
    "dateUpdated": "2024-08-02T19:09:49.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-6434-1

Vulnerability from osv_ubuntu

Published

2023-10-17 15:54

Modified

2026-04-27 14:11

Summary

pmix vulnerability

Details

Francois Diakhate discovered that PMIx did not properly handle race conditions in the pmix library, which could lead to unwanted privilege escalation. An attacker could possibly use this issue to obtain ownership of an arbitrary file on the filesystem, under the default configuration of the application.

References

URL

Type

	https://ubuntu.com/security/notices/USN-6434-1	ADVISORY
	https://ubuntu.com/security/CVE-2023-41915	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-41915",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libpmi1-pmix",
            "binary_version": "2.1.1~rc1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libpmi2-pmix",
            "binary_version": "2.1.1~rc1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libpmix2",
            "binary_version": "2.1.1~rc1-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "pmix",
        "purl": "pkg:deb/ubuntu/pmix@2.1.1~rc1-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.1~rc1-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.0~rc1-1",
        "2.1.0~rc1-2",
        "2.1.0~rc1-3",
        "2.1.0-1",
        "2.1.0-2",
        "2.1.1~rc1-1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-41915",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libpmi1-pmix",
            "binary_version": "3.1.5-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libpmi2-pmix",
            "binary_version": "3.1.5-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libpmix2",
            "binary_version": "3.1.5-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "pmix",
        "purl": "pkg:deb/ubuntu/pmix@3.1.5-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.5-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.4-1",
        "3.1.4-1build1",
        "3.1.5-1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-41915",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libpmix-bin",
            "binary_version": "4.1.2-2ubuntu1+esm1"
          },
          {
            "binary_name": "libpmix2",
            "binary_version": "4.1.2-2ubuntu1+esm1"
          },
          {
            "binary_name": "python3-pmix",
            "binary_version": "4.1.2-2ubuntu1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "pmix",
        "purl": "pkg:deb/ubuntu/pmix@4.1.2-2ubuntu1+esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.2-2ubuntu1+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.1.0-3ubuntu1",
        "4.1.0-3ubuntu2",
        "4.1.1~rc6-1ubuntu1",
        "4.1.2-2ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "Francois Diakhate discovered that PMIx did not properly handle race \nconditions in the pmix library, which could lead to unwanted privilege\nescalation. An attacker could possibly use this issue to obtain ownership\nof an arbitrary file on the filesystem, under the default configuration\nof the application.\n",
  "id": "USN-6434-1",
  "modified": "2026-04-27T14:11:31Z",
  "published": "2023-10-17T15:54:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6434-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-41915"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "pmix vulnerability",
  "upstream": [
    "UBUNTU-CVE-2023-41915"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2023-41915

Vulnerability from osv_ubuntu

CVE-2023-41915 (GCVE-0-2023-41915)

usn-6434-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature