CVE-2023-41915
📋 TL;DR
This vulnerability is a race condition in OpenPMIx that allows attackers to gain ownership of arbitrary files when the library code runs with root privileges (UID 0). It affects systems using vulnerable versions of OpenPMIx, particularly in HPC and cluster computing environments where PMIx is used for process management.
💻 Affected Systems
- OpenPMIx
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Openpmix by Openpmix
Openpmix by Openpmix
⚠️ Risk & Real-World Impact
Worst Case
Attackers could take ownership of critical system files (like /etc/passwd, /etc/shadow) and gain full root control of the system, potentially leading to complete system compromise.
Likely Case
Local attackers could escalate privileges to root by manipulating file ownership during the race condition window, allowing them to execute arbitrary code with elevated privileges.
If Mitigated
If proper access controls and privilege separation are implemented, the impact is limited to the specific user context where PMIx runs, preventing full system compromise.
🎯 Exploit Status
Exploitation requires local access and precise timing to win the race condition. The vulnerability is in the CWE-362 category (Concurrent Execution using Shared Resource with Improper Synchronization).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenPMIx 4.2.6 and 5.0.1
Vendor Advisory: https://docs.openpmix.org/en/latest/security.html
Restart Required: Yes
Instructions:
1. Identify OpenPMIx version currently installed. 2. Download and install OpenPMIx 4.2.6 or 5.0.1 from official sources. 3. Recompile any applications linked against PMIx. 4. Restart services using PMIx.
🔧 Temporary Workarounds
Run PMIx without root privileges
linuxConfigure systems to run PMIx library code without UID 0 where possible
# Review and modify service configurations to avoid running PMIx as root
# Use privilege separation mechanisms
Restrict file system access
linuxImplement strict file permissions and access controls to limit potential damage
# chmod 600 sensitive files
# Implement mandatory access controls (SELinux/AppArmor)
🧯 If You Can't Patch
- Implement strict access controls and audit all users with local access
- Monitor for suspicious file ownership changes and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check OpenPMIx version: pmix_info --version or examine installed packagesCheck Version:
pmix_info --version 2>/dev/null || rpm -q openpmix || dpkg -l | grep pmixVerify Fix Applied:
Verify version is 4.2.6 or higher for 4.x branch, or 5.0.1 or higher for 5.x branch📡 Detection & Monitoring
Log Indicators:
- Unexpected file ownership changes
- Processes running with unexpected UID 0
- Failed privilege escalation attempts
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
source="*auth.log*" AND ("setuid" OR "permission denied" OR "ownership changed")🔗 References
- http://www.openwall.com/lists/oss-security/2024/07/10/3
- http://www.openwall.com/lists/oss-security/2024/07/10/4
- http://www.openwall.com/lists/oss-security/2024/07/10/6
- http://www.openwall.com/lists/oss-security/2024/07/11/3
- https://docs.openpmix.org/en/latest/security.html
- https://github.com/openpmix/openpmix/releases/tag/v4.2.6
- https://github.com/openpmix/openpmix/releases/tag/v5.0.1
- https://lists.debian.org/debian-lts-announce/2023/10/msg00048.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFKIY6SNC3KQNZMVROWMIW6DI5XPNKQX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYJ7IRNR6NHJMTNOV3E3W3D5MLDRDCJX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDLWSMQYXF2ZGOQKCG26H6ZZA5FEH7HX/
- https://www.debian.org/security/2023/dsa-5547
- http://www.openwall.com/lists/oss-security/2024/07/10/3
- http://www.openwall.com/lists/oss-security/2024/07/10/4
- http://www.openwall.com/lists/oss-security/2024/07/10/6
- http://www.openwall.com/lists/oss-security/2024/07/11/3
- https://docs.openpmix.org/en/latest/security.html
- https://github.com/openpmix/openpmix/releases/tag/v4.2.6
- https://github.com/openpmix/openpmix/releases/tag/v5.0.1
- https://lists.debian.org/debian-lts-announce/2023/10/msg00048.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFKIY6SNC3KQNZMVROWMIW6DI5XPNKQX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYJ7IRNR6NHJMTNOV3E3W3D5MLDRDCJX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDLWSMQYXF2ZGOQKCG26H6ZZA5FEH7HX/
- https://www.debian.org/security/2023/dsa-5547
