6.7

CVE-2019-6133

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Polkit Project ≫ Polkit Version 0.115
Debian ≫ Debian Linux Version 8.0
Canonical ≫ Ubuntu Linux Version 12.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.10
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.45% 0.354
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.7 0.8 5.9
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
NIST 4.4 3.4 6.4
AV:L/AC:M/Au:N/C:P/I:P/A:P
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

https://usn.ubuntu.com/3910-1/
Third Party Advisory
https://usn.ubuntu.com/3910-2/
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html
https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html
https://lists.debian.org/debian-lts-announce/2019/01/msg00021.html
Third Party Advisory
Mailing List
https://usn.ubuntu.com/3901-1/
Third Party Advisory
https://usn.ubuntu.com/3901-2/
Third Party Advisory
https://usn.ubuntu.com/3903-1/
Third Party Advisory
https://usn.ubuntu.com/3903-2/
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00049.html
http://www.securityfocus.com/bid/106537
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:0230
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0420
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0832
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2699
https://access.redhat.com/errata/RHSA-2019:2978
https://bugs.chromium.org/p/project-zero/issues/detail?id=1692
Third Party Advisory
Mailing List
Issue Tracking
https://git.kernel.org/linus/7b55851367136b1efd84d98fea81ba57a98304cf
Patch
Third Party Advisory
https://gitlab.freedesktop.org/polkit/polkit/commit/c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81
Patch
Third Party Advisory
https://gitlab.freedesktop.org/polkit/polkit/merge_requests/19
Patch
Third Party Advisory
https://support.f5.com/csp/article/K22715344
Third Party Advisory
https://usn.ubuntu.com/3908-1/
Third Party Advisory
https://usn.ubuntu.com/3908-2/
Third Party Advisory
https://usn.ubuntu.com/3934-1/
Third Party Advisory
https://usn.ubuntu.com/3934-2/