CVEvulnerability
CVE-2019-6133
6.7 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-01-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.7 MEDIUM — CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-362
Description
In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.
Affected configurations
• polkit project polkit 0.115
• debian debian linux 8.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux server 7.0
• redhat enterprise linux server aus 7.6
• redhat enterprise linux server eus 7.6
• redhat enterprise linux server tus 7.6
• redhat enterprise linux workstation 7.0
• redhat enterprise linux desktop 6.0
• redhat enterprise linux server 6.0
• redhat enterprise linux server aus 6.6
• redhat enterprise linux workstation 6.0
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 18.10
Related
Weakness · CWE (1)
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00049.html lists.opensuse.org
- http://www.securityfocus.com/bid/106537 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:0230 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0420 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0832 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2699 access.redhat.com
- https://access.redhat.com/errata/RHSA-2019:2978 access.redhat.com
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1692 Issue Tracking, Mailing List, Third Party Advisory
- https://git.kernel.org/linus/7b55851367136b1efd84d98fea81ba57a98304cf Patch, Third Party Advisory
- https://gitlab.freedesktop.org/polkit/polkit/commit/c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81 Patch, Third Party Advisory
- https://gitlab.freedesktop.org/polkit/polkit/merge_requests/19 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/01/msg00021.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html lists.debian.org
- https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html lists.debian.org
- https://support.f5.com/csp/article/K22715344 Third Party Advisory
- https://usn.ubuntu.com/3901-1/ Third Party Advisory
- https://usn.ubuntu.com/3901-2/ Third Party Advisory
- https://usn.ubuntu.com/3903-1/ Third Party Advisory
- https://usn.ubuntu.com/3903-2/ Third Party Advisory
- https://usn.ubuntu.com/3908-1/ Third Party Advisory
- https://usn.ubuntu.com/3908-2/ Third Party Advisory
- https://usn.ubuntu.com/3910-1/ Third Party Advisory
- https://usn.ubuntu.com/3910-2/ Third Party Advisory
- https://usn.ubuntu.com/3934-1/ Third Party Advisory
- https://usn.ubuntu.com/3934-2/ usn.ubuntu.com
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00049.html lists.opensuse.org
- http://www.securityfocus.com/bid/106537 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:0230 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0420 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0832 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2699 access.redhat.com
- https://access.redhat.com/errata/RHSA-2019:2978 access.redhat.com
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1692 Issue Tracking, Mailing List, Third Party Advisory
- https://git.kernel.org/linus/7b55851367136b1efd84d98fea81ba57a98304cf Patch, Third Party Advisory
- https://gitlab.freedesktop.org/polkit/polkit/commit/c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81 Patch, Third Party Advisory
- https://gitlab.freedesktop.org/polkit/polkit/merge_requests/19 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/01/msg00021.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html lists.debian.org
- https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html lists.debian.org
- https://support.f5.com/csp/article/K22715344 Third Party Advisory
- https://usn.ubuntu.com/3901-1/ Third Party Advisory
- https://usn.ubuntu.com/3901-2/ Third Party Advisory
- https://usn.ubuntu.com/3903-1/ Third Party Advisory
- https://usn.ubuntu.com/3903-2/ Third Party Advisory
- https://usn.ubuntu.com/3908-1/ Third Party Advisory
- https://usn.ubuntu.com/3908-2/ Third Party Advisory
- https://usn.ubuntu.com/3910-1/ Third Party Advisory
- https://usn.ubuntu.com/3910-2/ Third Party Advisory
- https://usn.ubuntu.com/3934-1/ Third Party Advisory
- https://usn.ubuntu.com/3934-2/ usn.ubuntu.com