Race condition in Tang - CVE-2023-1672

Vulnerability identifier: #VU77575

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-1672

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a race condition in the Tang server functionality for key generation and key rotation, which results in a small time window where Tang server private keys become readable by any other process on the same host. The files are initially created with world readable permissions (0644), and only subsequently have more restrictive permissions applied (0440). A local user can exploit the race and obtain Tang private keys.

Tang
Oracle Linux
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Ubuntu
openEuler
Fedora
tang (Ubuntu package)
tang
tang-debugsource
tang-debuginfo
tang-help
tang (Red Hat package)
tang-common (Ubuntu package)

Install updates from vendor's website.

Tang - update to 14
tang (Ubuntu package) - addressed in versions Ubuntu Pro, 7-1ubuntu0.2
tang - update to 7-4
tang-debugsource - update to 7-4
tang-debuginfo - update to 7-4
tang-help - update to 7-4
tang - addressed in versions 7-8, 14-1
tang (Red Hat package) - addressed in versions 7-8.el8, 14-2.el9
tang-common (Ubuntu package) - addressed in versions 11-1ubuntu0.1, 11-2ubuntu0.1
tang - addressed in versions 14-1.fc37, 14-1.fc38

• https://census-labs.com/news/2023/06/15/race-tang/

• Information disclosure in Tang server
• Fedora 38 update for tang
• Fedora 37 update for tang
• Red Hat Enterprise Linux 9 update for tang
• Ubuntu update for tang
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 8 update for tang
• openEuler update for tang
• Anolis OS update for tang
• Anolis OS update for tang