Race condition in .NET and Visual Studio - CVE-2023-33170

Vulnerability identifier: #VU78213

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-33170

CWE-ID: CWE-362

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a race condition in the ASP.NET and Visual Studio. A remote attacker can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

.NET
Robotic Process Automation for Cloud Pak
Visual Studio
Amazon Linux AMI
Oracle Linux
Red Hat CodeReady Linux Builder for IBM z Systems
Anolis OS
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - AUS
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu
Fedora
dotnet-targeting-pack-6.0
dotnet-runtime-6.0
dotnet-hostfxr-6.0
dotnet-host
dotnet-apphost-pack-6.0
aspnetcore-targeting-pack-6.0
aspnetcore-runtime-6.0
aspnetcore-runtime-6.0 (Ubuntu package)
dotnet-hostfxr-6.0 (Ubuntu package)
dotnet-runtime-6.0 (Ubuntu package)
dotnet-host (Ubuntu package)
dotnet6 (Ubuntu package)
dotnet-sdk-6.0 (Ubuntu package)
dotnet6.0
rh-dotnet60-dotnet (Red Hat package)
dotnet6.0 (Red Hat package)
netstandard-targeting-pack-2.1
dotnet-templates-6.0
dotnet-sdk-6.0-source-built-artifacts
dotnet-sdk-6.0
dotnet
dotnet-host-7.0 (Ubuntu package)
dotnet-runtime-7.0 (Ubuntu package)
dotnet7 (Ubuntu package)
dotnet-hostfxr-7.0 (Ubuntu package)
aspnetcore-runtime-7.0 (Ubuntu package)
dotnet-sdk-7.0 (Ubuntu package)
dotnet7.0 (Red Hat package)
dotnet7.0
IBM Robotic Process Automation

Install updates from vendor's website.

dotnet-targeting-pack-6.0 - update to 6.0.20-1.0.1
dotnet-runtime-6.0 - update to 6.0.20-1.0.1
dotnet-hostfxr-6.0 - update to 6.0.20-1.0.1
dotnet-host - update to 6.0.20-1.0.1
dotnet-apphost-pack-6.0 - update to 6.0.20-1.0.1
aspnetcore-targeting-pack-6.0 - update to 6.0.20-1.0.1
aspnetcore-runtime-6.0 - update to 6.0.20-1.0.1
aspnetcore-runtime-6.0 (Ubuntu package) - addressed in versions 6.0.120-0ubuntu1~22.04.1, 6.0.120-0ubuntu1~22.10.1, 6.0.120-0ubuntu1~23.04.1
dotnet-hostfxr-6.0 (Ubuntu package) - addressed in versions 6.0.120-0ubuntu1~22.04.1, 6.0.120-0ubuntu1~22.10.1, 6.0.120-0ubuntu1~23.04.1
dotnet-runtime-6.0 (Ubuntu package) - addressed in versions 6.0.120-0ubuntu1~22.04.1, 6.0.120-0ubuntu1~22.10.1, 6.0.120-0ubuntu1~23.04.1
dotnet-host (Ubuntu package) - addressed in versions 6.0.120-0ubuntu1~22.04.1, 6.0.120-0ubuntu1~22.10.1, 6.0.120-0ubuntu1~23.04.1
dotnet6 (Ubuntu package) - addressed in versions 6.0.120-0ubuntu1~22.04.1, 6.0.120-0ubuntu1~22.10.1, 6.0.120-0ubuntu1~23.04.1
dotnet-sdk-6.0 (Ubuntu package) - addressed in versions 6.0.120-0ubuntu1~22.04.1, 6.0.120-0ubuntu1~22.10.1, 6.0.120-0ubuntu1~23.04.1
dotnet6.0 - update to 6.0.120-1
rh-dotnet60-dotnet (Red Hat package) - update to 6.0.120-1.el7_9
dotnet6.0 (Red Hat package) - addressed in versions 6.0.120-1.el8_6, 6.0.120-1.el8_8, 6.0.120-1.el9_0, 6.0.120-1.el9_2
dotnet6.0 - addressed in versions 6.0.120-1.fc37, 6.0.120-1.fc38
netstandard-targeting-pack-2.1 - update to 6.0.120-1.0.1
dotnet-templates-6.0 - update to 6.0.120-1.0.1
dotnet-sdk-6.0-source-built-artifacts - update to 6.0.120-1.0.1
dotnet-sdk-6.0 - update to 6.0.120-1.0.1
dotnet - update to 6.0.120-1.0.1
dotnet-host-7.0 (Ubuntu package) - addressed in versions 7.0.109-0ubuntu1~22.04.1, 7.0.109-0ubuntu1~22.10.1, 7.0.109-0ubuntu1~23.04.1
dotnet-runtime-7.0 (Ubuntu package) - addressed in versions 7.0.109-0ubuntu1~22.04.1, 7.0.109-0ubuntu1~22.10.1, 7.0.109-0ubuntu1~23.04.1
dotnet7 (Ubuntu package) - addressed in versions 7.0.109-0ubuntu1~22.04.1, 7.0.109-0ubuntu1~22.10.1, 7.0.109-0ubuntu1~23.04.1
dotnet-hostfxr-7.0 (Ubuntu package) - addressed in versions 7.0.109-0ubuntu1~22.04.1, 7.0.109-0ubuntu1~22.10.1, 7.0.109-0ubuntu1~23.04.1
aspnetcore-runtime-7.0 (Ubuntu package) - addressed in versions 7.0.109-0ubuntu1~22.04.1, 7.0.109-0ubuntu1~22.10.1, 7.0.109-0ubuntu1~23.04.1
dotnet-sdk-7.0 (Ubuntu package) - addressed in versions 7.0.109-0ubuntu1~22.04.1, 7.0.109-0ubuntu1~22.10.1, 7.0.109-0ubuntu1~23.04.1
dotnet7.0 (Red Hat package) - addressed in versions 7.0.109-1.el8_8, 7.0.109-1.el9_2
dotnet7.0 - addressed in versions 7.0.109-1.fc37, 7.0.109-1.fc38
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.8, 23.0.9
IBM Robotic Process Automation - addressed in versions 21.0.7.8, 23.0.9

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170

• Race condition in Microsoft ASP.NET and Visual Studio
• Ubuntu update for dotnet6
• Red Hat Enterprise Linux 9 update for .NET 7.0
• Red Hat Enterprise Linux 8 update for .NET 7.0
• Red Hat Enterprise Linux 8 update for .NET 6.0
• Red Hat Enterprise Linux 9 update for .NET 6.0
• Red Hat Enterprise Linux 7 update for .NET 6.0
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 8.6 Extended Update Support update for .NET 6.0
• Red Hat Enterprise Linux 9.0 Extended Update Support update for .NET 6.0
• Fedora 38 update for dotnet7.0
• Fedora 37 update for dotnet7.0
• Fedora 38 update for dotnet6.0
• Fedora 37 update for dotnet6.0
• Race condition in IBM Robotic Process Automation
• Amazon Linux AMI update for dotnet6.0
• Anolis OS update for dotnet6.0