OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3008 advisory.

    [2.2.5-3]
    - Add gating test
    - Resolves: RHEL-3692

    [2.2.5-2]
    - Fix CVE-2023-41915
    - Resolves: RHEL-3692

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3008 advisory.

    The Process Management Interface (PMI) provides process management functions for MPI implementations. PMI     Exascale (PMIx) provides an extended version of the PMI standard specifically designed to support clusters     up to and including exascale sizes.

    Security Fix(es):

    * pmix: race condition allows attackers to obtain ownership of arbitrary files (CVE-2023-41915)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3008 advisory.

  - OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files     via a race condition during execution of library code with UID 0. (CVE-2023-41915)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2199 advisory.

  - OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files     via a race condition during execution of library code with UID 0. (CVE-2023-41915)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2199 advisory.

    The Process Management Interface (PMI) provides process management functions for MPI implementations. PMI     Exascale (PMIx) provides an extended version of the PMI standard specifically designed to support clusters     up to and including exascale sizes.

    Security Fix(es):

    * pmix: race condition allows attackers to obtain ownership of arbitrary files (CVE-2023-41915)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-1185eca900 advisory.

  - OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files     via a race condition during execution of library code with UID 0. (CVE-2023-41915)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5547 advisory.

  - OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files     via a race condition during execution of library code with UID 0. (CVE-2023-41915)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3643 advisory.

  - OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files     via a race condition during execution of library code with UID 0. (CVE-2023-41915)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6434-1 advisory.

    Francois Diakhate discovered that PMIx did not properly handle race

    conditions in the pmix library, which could lead to unwanted privilege escalation. An attacker could     possibly use this issue to obtain ownership of an arbitrary file on the filesystem, under the default     configuration of the application.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-d6dbdf62ad advisory.

  - OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files     via a race condition during execution of library code with UID 0. (CVE-2023-41915)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-155d2f22f1 advisory.

  - OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files     via a race condition during execution of library code with UID 0. (CVE-2023-41915)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-363 advisory.

  - OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files     via a race condition during execution of library code with UID 0. (CVE-2023-41915)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3859-1 advisory.

  - OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files     via a race condition during execution of library code with UID 0. (CVE-2023-41915)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of pmix installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-41915 advisory.

  - OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files     via a race condition during execution of library code with UID 0. (CVE-2023-41915)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198022	Oracle Linux 8 : pmix (ELSA-2024-3008)	Nessus	Oracle Linux Local Security Checks	high
197756	RHEL 8 : pmix (RHSA-2024:3008)	Nessus	Red Hat Local Security Checks	high
197688	CentOS 8 : pmix (CESA-2024:3008)	Nessus	CentOS Local Security Checks	high
195050	Oracle Linux 9 : pmix (ELSA-2024-2199)	Nessus	Oracle Linux Local Security Checks	high
194759	RHEL 9 : pmix (RHSA-2024:2199)	Nessus	Red Hat Local Security Checks	high
185278	Fedora 39 : openmpi / pmix / prrte / slurm (2023-1185eca900)	Nessus	Fedora Local Security Checks	high
184434	Debian DSA-5547-1 : pmix - security update	Nessus	Debian Local Security Checks	high
184094	Debian DLA-3643-1 : pmix - LTS security update	Nessus	Debian Local Security Checks	high
183308	Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM : PMIx vulnerability (USN-6434-1)	Nessus	Ubuntu Local Security Checks	high
182479	Fedora 38 : openmpi / pmix / prrte / slurm (2023-d6dbdf62ad)	Nessus	Fedora Local Security Checks	high
182478	Fedora 37 : openmpi / pmix / prrte / slurm (2023-155d2f22f1)	Nessus	Fedora Local Security Checks	high
182461	Amazon Linux 2023 : pmix, pmix-devel, pmix-pmi (ALAS2023-2023-363)	Nessus	Amazon Linux Local Security Checks	high
182179	SUSE SLES15 / openSUSE 15 Security Update : pmix (SUSE-SU-2023:3859-1)	Nessus	SuSE Local Security Checks	high
182158	CBL Mariner 2.0 Security Update: pmix (CVE-2023-41915)	Nessus	MarinerOS Local Security Checks	high

Detections

Analytics

CVE-2023-41915

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high