SB2024082945 - Multiple vulnerabilities in IBM Concert

Description

This security bulletin contains information about 22 secuirty vulnerabilities.

1) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2024-23650)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling. A remote attacker can send specially crafted data to the application and perform a denial of service (DoS) attack.

2) Improper validation of integrity check value (CVE-ID: CVE-2024-3727)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper validation of integrity check. A remote attacker can trick the victim into providing authenticated registry accesses, causing resource exhaustion, local path traversal, and other attacks.

3) Incorrect Resource Transfer Between Spheres (CVE-ID: CVE-2024-29018)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application within external DNS requests from "internal" networks. A remote attacker can gain unauthorized access to sensitive information on the system.

4) Use of uninitialized variable (CVE-ID: CVE-2024-26147)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to usage of an uninitialized variable when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. If index.yaml file or a plugins plugin.yaml file are missing in the repository, the application crashes.

5) Path traversal (CVE-ID: CVE-2024-25620)

The vulnerability allows a remote user to overwrite arbitrary files on the system.

The vulnerability exists due to input validation error when processing directory traversal sequences when saving charts at Chart.yaml. A remote user can send a specially crafted HTTP request and overwrite arbitrary files on the system.

6) Infinite loop (CVE-ID: CVE-2024-24786)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when parsing data in an invalid JSON format within the protojson.Unmarshal() function. A remote attacker can consume all available system resources and cause denial of service conditions.

7) Insufficient verification of data authenticity (CVE-ID: CVE-2024-24557)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient verification of data authenticity. A remote attacker can poison victim´s cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps.

8) Incorrect authorization (CVE-ID: CVE-2024-23653)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to interactive containers API does not validate entitlements check. A remote attacker can use these APIs to ask BuildKit to run a container with elevated privileges.

9) Path traversal (CVE-ID: CVE-2024-23652)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within BuildKit frontend or Dockerfile using RUN --mount. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

10) Race condition (CVE-ID: CVE-2024-23651)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a race condition. A remote attacker can exploit the race and cause the files from the host system being accessible to the build container.

11) Inadequate encryption strength (CVE-ID: CVE-2023-48795)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to incorrect implementation of the SSH Binary Packet Protocol (BPP), which mishandles the handshake phase and the use of sequence numbers. A remote attacker can perform MitM attack and delete the SSH2_MSG_EXT_INFO message sent before authentication starts, allowing the attacker to disable a subset of the keystroke timing obfuscation features introduced in OpenSSH 9.5.

The vulnerability was dubbed "Terrapin attack" and it affects both client and server implementations.

12) Information disclosure (CVE-ID: CVE-2020-12912)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Running Average Power Limit (RAPL) interface. A local user can gain unauthorized access to sensitive information on the system.

13) Resource exhaustion (CVE-ID: CVE-2023-45288)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single HTTP/2 stream. A remote attacker can send specially crafted HTTP/2 requests to the server and perform a denial of service (DoS) attack.

14) Input validation error (CVE-ID: CVE-2023-45284)

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to the IsLocal() function from the path/filepath package does not correctly detect reserved device names in some cases when executed on Windows. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. A local user can abuse such behavior and bypass implemented security restrictions.

15) Resource exhaustion (CVE-ID: CVE-2023-39326)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling HTTP chunked requests. A remote attacker can send specially crafted HTTP requests to the server and consume excessive memory resources.

16) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2022-41721)

The vulnerability allows a remote attacker to perform HTTP/2 request smuggling attacks.

The vulnerability exists due to improper validation of HTTP/2 requests when using MaxBytesHandler. A remote attacker can send a specially crafted HTTP/2 request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

17) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-29162)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to containers are incorrectly started with non-empty inheritable Linux process capabilities, which leads to security restrictions bypass and privilege escalation.

18) Incorrect authorization (CVE-ID: CVE-2022-24778)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists in imgcrypt library when checking the keys of an authorized user to access an encrypted image on systems where layers are not available and cannot run on the host architecture. A remote attacker can run an image without providing the previously decrypted keys and gain access to sensitive information.

19) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-24769)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to containers are incorrectly started with non-empty inheritable Linux process capabilities, which leads to security restrictions bypass and privilege escalation.

20) Resource exhaustion (CVE-ID: CVE-2022-23471)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in containerd CRI stream server when handling terminal resize events. A remote user can request a TTY and force it to fail by sending a faulty command and exhaust memory on the host.

21) Observable Response Discrepancy (CVE-ID: CVE-2020-8695)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to observable discrepancy in the Running Average Power Limit (RAPL) Interface. A local administrator can gain access to sensitive information on the target system.

Affected products:

Product Collection	Vertical Segment	CPUID
8th Generation Intel® Core™ Processor Family	Mobile	806E9
10th Generation Intel® Core™ Processor Family	Mobile	806EC
8th Generation Intel® Core™ Processor Family	Mobile	906EA
9th Generation Intel® Core™ Processor Family	Mobile	906EC
8th Generation Intel® Core™ Processor Family	Desktop	906EA
9th Generation Intel® Core™ Processor Family	Desktop	906EC
Intel® Xeon® Processor E Family	Server Workstation AMT Server	906EA
8th Generation Intel® Core™ Processor Family	Mobile	806EA
8th Generation Intel® Core™ Processor Family Intel® Pentium® Gold Processor Series Intel® Celeron® Processor G Series	Desktop	906EB
Intel® Xeon® Processor E Family	Server Workstation AMT Server	906EA
8th Generation Intel® Core™ Processor Family	Desktop	906EA
9th Generation Intel® Core™ Processor Family	Desktop	906ED
9th Generation Intel® Core™ Processor Family	Desktop	906ED
10th Generation Intel® Core™ Processor Family	Mobile	A0660
10th Generation Intel® Core™ Processor Family	Mobile	A0661
10th Generation Intel® Core™ Processor Family	Mobile	806EC
10th Generation Intel® Core™ Processor Family	Desktop	A0653
10th Generation Intel® Core™ Processor Family	Mobile	A0655
10th Generation Intel® Core™ Processor Family	Mobile	A0652
Intel® Pentium® Processor Silver Series Intel® Celeron® Processor J Series Intel® Celeron® Processor N Series	Desktop Mobile Embedded	706A1
Intel® Pentium® Processor Silver Series Intel® Celeron® Processor J Series Intel® Celeron® Processor N Series	Desktop Mobile Embedded	706A8
10th Generation Intel® Core™ Processor Family	Mobile	706E5
8th Generation Intel® Core™ Processor Family	Mobile	906E9
7th Generation Intel® Core™ Processor Family	Mobile Embedded	906E9
8th Generation Intel® Core™  Processor Family	Mobile	806EA
7th Generation Intel® Core™ Processor Family	Desktop Embedded	906E9
7th Generation Intel® Core™ Processor Family	Mobile	806E9
7th Generation Intel® Core™ Processor Family	Mobile	806E9
Intel® Core™ X-series Processors	Desktop	906E9
Intel® Xeon® Processor E3 v6 Family	Server Workstation AMT Server	906E9
7th Generation Intel® Core™ Processor Family	Mobile	806E9
6th Generation Intel® Core™ Processor Family	Mobile	506E3
6th Generation Intel® Core™ Processor Family	Desktop Embedded	506E3
6th Generation Intel® Core™ Processors	Mobile	406E3
6th Generation Intel® Core™ Processor Family	Mobile	406E3
Intel® Xeon® Processor E3 v5 Family	Server Workstation AMT Server	506E3
6th Generation Intel® Core™ Processor Family	Mobile	406E3
8th Generation Intel® Core™ Processors	Mobile	806EB
8th Generation Intel® Core™ Processors	Mobile	806EC

22) Improper access control (CVE-ID: CVE-2020-8694)

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the Linux kernel driver. A local user can bypass implemented security restrictions and gain unauthorized access to sensitive information on the system.

Affected products:

Product Collection	Vertical Segment	CPUID
8th Generation Intel® Core™ Processor Family	Mobile	806E9
10th Generation Intel® Core™ Processor Family	Mobile	806EC
8th Generation Intel® Core™ Processor Family	Mobile	906EA
9th Generation Intel® Core™ Processor Family	Mobile	906EC
8th Generation Intel® Core™ Processor Family	Desktop	906EA
9th Generation Intel® Core™ Processor Family	Desktop	906EC
Intel® Xeon® Processor E Family	Server Workstation AMT Server	906EA
8th Generation Intel® Core™ Processor Family	Mobile	806EA
8th Generation Intel® Core™ Processor Family Intel® Pentium® Gold Processor Series Intel® Celeron® Processor G Series	Desktop	906EB
Intel® Xeon® Processor E Family	Server Workstation AMT Server	906EA
8th Generation Intel® Core™ Processor Family	Desktop	906EA
9th Generation Intel® Core™ Processor Family	Desktop	906ED
9th Generation Intel® Core™ Processor Family	Desktop	906ED
10th Generation Intel® Core™ Processor Family	Mobile	A0660
10th Generation Intel® Core™ Processor Family	Mobile	A0661
10th Generation Intel® Core™ Processor Family	Mobile	806EC
10th Generation Intel® Core™ Processor Family	Desktop	A0653
10th Generation Intel® Core™ Processor Family	Mobile	A0655
10th Generation Intel® Core™ Processor Family	Mobile	A0652
Intel® Pentium® Processor Silver Series Intel® Celeron® Processor J Series Intel® Celeron® Processor N Series	Desktop Mobile Embedded	706A1
Intel® Pentium® Processor Silver Series Intel® Celeron® Processor J Series Intel® Celeron® Processor N Series	Desktop Mobile Embedded	706A8
10th Generation Intel® Core™ Processor Family	Mobile	706E5
8th Generation Intel® Core™ Processor Family	Mobile	906E9
7th Generation Intel® Core™ Processor Family	Mobile Embedded	906E9
8th Generation Intel® Core™  Processor Family	Mobile	806EA
7th Generation Intel® Core™ Processor Family	Desktop Embedded	906E9
7th Generation Intel® Core™ Processor Family	Mobile	806E9
7th Generation Intel® Core™ Processor Family	Mobile	806E9
Intel® Core™ X-series Processors	Desktop	906E9
Intel® Xeon® Processor E3 v6 Family	Server Workstation AMT Server	906E9
7th Generation Intel® Core™ Processor Family	Mobile	806E9
6th Generation Intel® Core™ Processor Family	Mobile	506E3
6th Generation Intel® Core™ Processor Family	Desktop Embedded	506E3
6th Generation Intel® Core™ Processors	Mobile	406E3
6th Generation Intel® Core™ Processor Family	Mobile	406E3
Intel® Xeon® Processor E3 v5 Family	Server Workstation AMT Server	506E3
6th Generation Intel® Core™ Processor Family	Mobile	406E3
8th Generation Intel® Core™ Processors	Mobile	806EB
8th Generation Intel® Core™ Processors	Mobile	806EC

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/support/pages/node/7166857