Permissions, Privileges, and Access Controls in Microsoft .NET Core and Visual Studio - CVE-2022-41032

Vulnerability identifier: #VU68170

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-41032

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the NuGet Client, which leads to security restrictions bypass and privilege escalation.

Microsoft .NET Core
Visual Studio
rh-dotnet31-dotnet (Red Hat package)
dotnet3.1 (Red Hat package)
rh-dotnet60-dotnet (Red Hat package)
dotnet6.0 (Red Hat package)
dotnet-targeting-pack-3.1
aspnetcore-targeting-pack-3.1
aspnetcore-runtime-3.1
dotnet-apphost-pack-3.1
dotnet-hostfxr-3.1
dotnet-runtime-3.1
dotnet3.1
dotnet-templates-3.1
dotnet-sdk-3.1-source-built-artifacts
dotnet-sdk-3.1
aspnetcore-targeting-pack-6.0
aspnetcore-runtime-6.0
dotnet-apphost-pack-6.0
dotnet-host
dotnet-hostfxr-6.0
dotnet-runtime-6.0
dotnet-targeting-pack-6.0
dotnet6.0
dotnet-hostfxr-6.0 (Ubuntu package)
aspnetcore-runtime-6.0 (Ubuntu package)
dotnet6 (Ubuntu package)
dotnet-host (Ubuntu package)
dotnet-sdk-6.0 (Ubuntu package)
dotnet-runtime-6.0 (Ubuntu package)
dotnet
netstandard-targeting-pack-2.1
dotnet-templates-6.0
dotnet-sdk-6.0-source-built-artifacts
dotnet-sdk-6.0
dotnet7.0 (Red Hat package)
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Oracle Linux
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Ubuntu
Fedora
SINEC PNI
Robotic Process Automation for Cloud Pak

Install updates from vendor's website.

rh-dotnet31-dotnet (Red Hat package) - update to 3.1.424-1.el7_9
dotnet3.1 (Red Hat package) - update to 3.1.424-1.el8_6
rh-dotnet60-dotnet (Red Hat package) - update to 6.0.110-1.el7_9
dotnet6.0 (Red Hat package) - addressed in versions 6.0.110-1.el8_6, 6.0.110-1.el9_0
SINEC PNI - update to 2.0
dotnet-targeting-pack-3.1 - update to 3.1.30-1.0.1
aspnetcore-targeting-pack-3.1 - update to 3.1.30-1.0.1
aspnetcore-runtime-3.1 - update to 3.1.30-1.0.1
dotnet-apphost-pack-3.1 - update to 3.1.30-1.0.1
dotnet-hostfxr-3.1 - update to 3.1.30-1.0.1
dotnet-runtime-3.1 - update to 3.1.30-1.0.1
dotnet3.1 - addressed in versions 3.1.424-1.fc35, 3.1.424-1.fc36
dotnet-templates-3.1 - update to 3.1.424-1.0.1
dotnet-sdk-3.1-source-built-artifacts - update to 3.1.424-1.0.1
dotnet-sdk-3.1 - update to 3.1.424-1.0.1
aspnetcore-targeting-pack-6.0 - update to 6.0.10-1.0.1
aspnetcore-runtime-6.0 - update to 6.0.10-1.0.1
dotnet-apphost-pack-6.0 - update to 6.0.10-1.0.1
dotnet-host - update to 6.0.10-1.0.1
dotnet-hostfxr-6.0 - update to 6.0.10-1.0.1
dotnet-runtime-6.0 - update to 6.0.10-1.0.1
dotnet-targeting-pack-6.0 - update to 6.0.10-1.0.1
dotnet6.0 - addressed in versions 6.0.109-1.fc36, 6.0.110-2.fc35, 6.0.110-2.fc36, 6.0.110-2.fc37
dotnet-hostfxr-6.0 (Ubuntu package) - update to 6.0.110-0ubuntu1~22.04.1
aspnetcore-runtime-6.0 (Ubuntu package) - update to 6.0.110-0ubuntu1~22.04.1
dotnet6 (Ubuntu package) - update to 6.0.110-0ubuntu1~22.04.1
dotnet-host (Ubuntu package) - update to 6.0.110-0ubuntu1~22.04.1
dotnet-sdk-6.0 (Ubuntu package) - update to 6.0.110-0ubuntu1~22.04.1
dotnet-runtime-6.0 (Ubuntu package) - update to 6.0.110-0ubuntu1~22.04.1
dotnet - update to 6.0.110-1.0.1
netstandard-targeting-pack-2.1 - update to 6.0.110-1.0.1
dotnet-templates-6.0 - update to 6.0.110-1.0.1
dotnet-sdk-6.0-source-built-artifacts - update to 6.0.110-1.0.1
dotnet-sdk-6.0 - update to 6.0.110-1.0.1
dotnet7.0 (Red Hat package) - addressed in versions 7.0.100-0.4.rc2.el8_7, 7.0.100-0.5.rc2.el9_1
Robotic Process Automation for Cloud Pak - update to 21.0.6

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41032

• Privilege escalation in Microsoft NuGet Client
• Ubuntu update for dotnet6
• Red Hat Enterprise Linux 8 update for .NET Core 3.1
• Red Hat Enterprise Linux 8 update for .NET 6.0
• Red Hat Enterprise Linux 9 update for .NET 6.0
• Red Hat Enterprise Linux 7 update for .NET Core 3.1
• Red Hat Enterprise Linux 7 update for .NET Core 3.1
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 8 update for dotnet7.0
• Red Hat Enterprise Linux 9 update for dotnet7.0
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in Siemens SINEC PNI
• Fedora 36 update for dotnet3.1
• Fedora 35 update for dotnet3.1
• Fedora 36 update for dotnet6.0
• Fedora 36 update for dotnet6.0
• Fedora 35 update for dotnet6.0
• Fedora 37 update for dotnet6.0
• Anolis OS update for dotnet3.1
• Anolis OS update for dotnet6.0