Red Hat Enterprise Linux: yggdrasil-worker-package-manager privilege escalation
A vulnerability in the yggdrasil-worker-package-manager component of Red Hat Enterprise Linux allows a remote attacker to achieve privilege escalation, enabling unauthorized file creation, overwriting, or deletion with root privileges.
Triage facts
Revision 1- Applicability
- Red Hat Enterprise Linux
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 16:06 UTC
- Source quality
- A1Likely
A vulnerability has been identified in the yggdrasil-worker-package-manager component within Red Hat Enterprise Linux. This flaw permits a remote attacker to perform unauthorized file operations, including creation, overwriting, or deletion, while operating with root-level privileges.
Impact
The vulnerability results in unauthorized modification or deletion of files on the filesystem with the privileges of the root user, potentially leading to full system compromise or service disruption.
Recommendation
- Identify all RHEL systems running the yggdrasil-worker-package-manager component.
- Monitor for security advisories from Red Hat regarding this component and apply the provided patches or configuration mitigations as soon as they become available.
- Implement file integrity monitoring (FIM) on critical system paths to detect unauthorized file creation or modification events by the yggdrasil worker process.
Immediate actions
Inventory RHEL systems running the yggdrasil-worker-package-manager package
Threat Hunt
Monitor system logs and auditd for unexpected file creation or modification in protected system directories performed by the yggdrasil-worker-package-manager process.
Data: auditd logs, system integrity monitoring logs
Mitigations
Apply relevant security patches from Red Hat as soon as released for the yggdrasil package.
yggdrasil-worker-package-manager privilege escalation