What happened
An identified vulnerability exists in OpenSCAP, specifically related to the decomposing process of Source DataStream (SDS) files. The flaw stems from improper validation of relative file path attributes within SDS files, creating a path traversal vulnerability. Attackers can exploit this by manipulating SDS files to include directory traversal sequences, which, when processed by affected applications, can lead to unintended file creation or modification outside the designated target directory. This may result in potential unauthorised system modifications or exploitations if successfully executed. The vulnerability requires local access to the host system and user interaction, such as opening a malicious SDS file. Exploitation does not depend on prior access but assumes the attacker already has some level of access on the system. The attack path involves the attacker leveraging existing or local access to the host and then exploiting the flawed processing of SDS files, making the risk primarily associated with privilege hygiene and endpoint security practices. While the specific patches or updates are not yet available, the vulnerability has been assigned a CVSS score of 6.1, indicating a medium severity. The impact of successful exploitation could involve high-impact modifications to files, extending the risk severity despite requiring targeted manipulation and user interaction. Who is affected Organisations running affected versions of Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, and Red Hat Hardened Images are potentially impacted. These deployments may process SDS files that can be exploited via the described path traversal method. The vulnerability affects systems where OpenSCAP is used and where SDS files are decomposed as part of the operational workflows. No information is available regarding exploitation or impact outside these environments. Recommended actions
Mitigate based on privilege hygiene by restricting local access to systems where OpenSCAP processes SDS files. Implement endpoint monitoring to detect unusual file creation or modification actions outside expected directories, especially when processing SDS files. Review security controls to prevent the opening or processing of potentially malicious SDS files, especially where user interaction is involved.
