Published: 09/09/2023 Updated: 09/01/2024

CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2

VMScore: 0

OpenPMIx PMIx prior to 4.2.6 and 5.0.x prior to 5.0.1 allows malicious users to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openpmix openpmix
openpmix openpmix 5.0.0
fedoraproject fedora 37
fedoraproject fedora 38
fedoraproject fedora 39
debian debian linux 10.0
debian debian linux 12.0

Debian Bug report logs - #1051729 pmix: CVE-2023-41915 Package: src:pmix; Maintainer for src:pmix is Alastair McKinstry <mckinstry@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 11 Sep 2023 19:39:01 UTC Severity: grave Tags: security, upstream Found in version pmix/500~rc1-2 Fixed in ...

Francois Diakhate reported that a race condition in pmix, a library implementing Process Management Interface (PMI) Exascale API, could allow a malicious user to obtain ownership of an arbitrary file on the filesystem when parts of the PMIx library are called by a process with elevated privileges, resulting in privilege escalation This may happen ...

DescriptionOpenPMIx PMIx is vulnerable to a race condition during execution of library code with UID 0, which allows attackers to obtain ownership of arbitrary filesOpenPMIx PMIx is vulnerable to a race condition during execution of library code with UID 0, which allows attackers to obtain ownership of arbitrary files ...

CWE-362 https://docs.openpmix.org/en/latest/security.html https://github.com/openpmix/openpmix/releases/tag/v5.0.1 https://github.com/openpmix/openpmix/releases/tag/v4.2.6 https://lists.debian.org/debian-lts-announce/2023/10/msg00048.html https://www.debian.org/security/2023/dsa-5547 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFKIY6SNC3KQNZMVROWMIW6DI5XPNKQX/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYJ7IRNR6NHJMTNOV3E3W3D5MLDRDCJX/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDLWSMQYXF2ZGOQKCG26H6ZZA5FEH7HX/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051729 https://nvd.nist.gov https://www.debian.org/security/2023/dsa-5547

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2023-41915

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect