CVE-2019-6133 Information

Description

In PolicyKit (aka polkit) 0.115 the \start time\ protection mechanism can be bypassed because fork() is not atomic and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

CVSS Vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Reference

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00049.html http://www.securityfocus.com/bid/106537 https://access.redhat.com/errata/RHSA-2019:0230 https://access.redhat.com/errata/RHSA-2019:0420 https://access.redhat.com/errata/RHSA-2019:0832 https://access.redhat.com/errata/RHSA-2019:2699 https://access.redhat.com/errata/RHSA-2019:2978 https://bugs.chromium.org/p/project-zero/issues/detail?id=1692 https://git.kernel.org/linus/7b55851367136b1efd84d98fea81ba57a98304cf https://gitlab.freedesktop.org/polkit/polkit/commit/c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81 https://gitlab.freedesktop.org/polkit/polkit/merge_requests/19 https://lists.debian.org/debian-lts-announce/2019/01/msg00021.html https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html https://support.f5.com/csp/article/K22715344 https://usn.ubuntu.com/3901-1/ https://usn.ubuntu.com/3901-2/ https://usn.ubuntu.com/3903-1/ https://usn.ubuntu.com/3903-2/ https://usn.ubuntu.com/3908-1/ https://usn.ubuntu.com/3908-2/ https://usn.ubuntu.com/3910-1/ https://usn.ubuntu.com/3910-2/ https://usn.ubuntu.com/3934-1/ https://usn.ubuntu.com/3934-2/

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction Required

LOW

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

6.7