CVE-2019-6133

CWE-362 — Race ConditionCWE-697CWE-284 — Improper Access Control20 documents9 sources
Severity
6.7MEDIUM
EPSS
0.0%
top 93.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Canonical Ubuntu LinuxDebian Debian LinuxPolkit Project Polkit+6 more
Timeline
PublishedJan 11
Latest updateMay 13

Description

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages6 packages

▶Debianpolicykit-1< 0.105-25+3
▶Debianlinux< 4.19.16-1+3

Also affects: Debian Linux 8.0, Ubuntu Linux 12.04, 14.04, 16.04, 18.04, 18.10, Enterprise Linux 6.6, 7.6

Patches

Patch: git.kernel.org ↗Patch: gitlab.freedesktop.org ↗Patch: gitlab.freedesktop.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-7j6c-jrh9-mvqm: In PolicyKit (aka polkit) 0↗2022-05-13
▶
OSV
linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-oracle, linux-raspi2 vulnerabilities↗2019-03-05
▶
OSV
CVE-2019-6133: In PolicyKit (aka polkit) 0↗2019-01-11
▶
CVEList
CVE-2019-6133: In PolicyKit (aka polkit) 0↗2019-01-11
▶

📋Vendor Advisories

12
Ubuntu
PolicyKit vulnerability↗2019-09-02
▶
Ubuntu
PolicyKit vulnerability↗2019-04-03
▶
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities↗2019-03-15
▶
Ubuntu
Linux kernel vulnerabilities↗2019-03-15
▶
Ubuntu
Linux kernel (Trusty HWE) vulnerability↗2019-03-13
▶

💬Community

2
Bugzilla
CVE-2019-6133 polkit: Temporary auth hijacking via PID reuse and non-atomic fork [fedora-all]↗2019-01-21
▶
Bugzilla
CVE-2019-6133 polkit: Temporary auth hijacking via PID reuse and non-atomic fork↗2019-01-08
▶
CVE-2019-6133 (MEDIUM CVSS 6.7) | In PolicyKit (aka polkit) 0.115 | cvebase.io