CVE-2023-38176

FAQ

What can an attacker do with this vulnerability?

An elevation of privilege vulnerability exists in the Azure Connected Machine Agent used with the Azure Arc-Enabled Servers service. This impacts both Linux and Windows servers. A low privilege user on the machine where the agent is installed can chain two vulnerabilities in HIMDS to get root/admin access on the server.

What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker who successfully exploited this vulnerability could gain administrator privileges.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to exploit two separate vulnerabilities to gain elevated privileges.