Security readout for executives and security teams
Plain-English summary
Tang briefly exposed private keys to other local processes during key generation or rotation. This matters most where Tang protects disk-unlock or similar infrastructure secrets. The issue is medium severity because an attacker needs local host access and timing, but successful exposure could compromise confidentiality of Tang private keys.
Executive priority
Prioritize within normal vulnerability management for systems where Tang protects high-value encryption workflows. Escalate if Tang runs on shared or weakly controlled hosts, because the confidentiality impact is high even though exploitation requires local timing and access.
Technical view
CVE-2023-1672 is a CWE-362 race condition in Tang key generation and rotation. During a small timing window, private keys can become readable by other processes on the same host. The CVSS 3.1 score is 5.3, with high confidentiality impact and no integrity or availability impact listed.
Likely exposure
Exposure is most likely on systems running the tang package, especially Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Fedora as listed affected. Red Hat Enterprise Linux 7 status is listed as unknown in the bundle. Confirm distribution package status directly with vendor advisories.
Exploitation context
The bundle does not show CISA KEV listing or cited evidence of active exploitation. Practical abuse appears local and timing-sensitive: another process on the same host would need access during key generation or rotation. Do not treat this as remotely exploitable based on the provided evidence.
Researcher notes
Key uncertainty is fixed-version mapping by distribution; the bundle provides affected product signals and an upstream commit but not complete package version ranges. Analysis should stay focused on local confidentiality exposure during Tang key lifecycle operations, not remote compromise.
Mitigation direction
- Apply vendor-provided tang updates for affected distributions.
- Use packages containing the upstream Tang fix commit where vendor-supported.
- Review Red Hat, Fedora, and distribution advisories for exact fixed package versions.
- Limit untrusted local code execution on Tang hosts.
- If exposure is suspected, follow vendor guidance before rotating Tang keys.
Validation and detection
- Inventory hosts with the tang package installed.
- Check whether each host runs RHEL 8, RHEL 9, Fedora, or another affected distribution.
- Verify installed tang package versions against vendor advisories.
- Review recent Tang key generation or rotation activity on shared hosts.
- Confirm local process isolation controls on Tang servers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-362: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-1672 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N1.63.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://access.redhat.com/security/cve/CVE-2023-1672CVE reference · vdb-entry, x_refsource_REDHAT
- RHBZ#2180999CVE reference · issue-tracking, x_refsource_REDHAT
- https://github.com/latchset/tang/commit/8dbbed10870378f1b2c3cf3df2ea7edca7617096CVE reference
- https://www.openwall.com/lists/oss-security/2023/06/15/1CVE reference
- https://lists.debian.org/debian-lts-announce/2023/11/msg00004.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.