attack vector is local; attack complexity is low; privileges required is low; user interaction is required; scope is changed; confidentiality impact is none; integrity impact is high; availability impact is high.
Affected products
Red Hat Enterprise Linux 10 and Red Hat Hardened Images
Classified as
CWE-775 (Missing Release of File Descriptor or Handle after Effective Lifetime)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Hardened Images
Subsystems
OT Supporting Infrastructure
Sectors
Multiple
What to Know
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases.