SB2023051542 - IBM Edge Application Manager update for runc 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023051542

SB2023051542 - IBM Edge Application Manager update for runc

Published: May 15, 2023

Security Bulletin ID SB2023051542
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Integer overflow (CVE-ID: CVE-2021-43784)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in netlink bytemsg length field. A remote authenticated attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-29162)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to containers are incorrectly started with non-empty inheritable Linux process capabilities, which leads to security restrictions bypass and privilege escalation.


Remediation

Install update from vendor's website.

References