Bug 1204886 (CVE-2022-42919)

Summary:	VUL-0: CVE-2022-42919: python39,python310: python: local privilege escalation via the multiprocessing forkserver start method
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Thomas Leroy <thomas.leroy>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	IN_PROGRESS ---	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	security-team
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/346621/
Whiteboard:	CVSSv3.1:SUSE:CVE-2022-42919:7.8:(AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Thomas Leroy 2022-10-31 10:27:29 UTC

rh#2138705

CVE-2022-42919:

Python 3.9, 3.10, and 3.11.0rc2 on Linux may allow for a local privilege escalation attack in a non-default configuration when code uses the multiprocessing module and configures multiprocessing to use the forkserver start method.

Reference:
https://github.com/python/cpython/issues/97514

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2138705
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-42919

Comment 1 Thomas Leroy 2022-10-31 10:30:03 UTC

The abstract socket support to communicate with the forkserver was added in 3.7.8 and 3.8.4. Therefore, only the following are affected:
- SUSE:SLE-15-SP4:Update/python310
- SUSE:SLE-15-SP3:Update/python39

Comment 2 OBSbugzilla Bot 2022-11-04 15:35:08 UTC

This is an autogenerated message for OBS integration:
This bug (1204886) was mentioned in
https://build.opensuse.org/request/show/1033552 Factory / python39

Comment 3 OBSbugzilla Bot 2022-11-04 17:35:03 UTC

This is an autogenerated message for OBS integration:
This bug (1204886) was mentioned in
https://build.opensuse.org/request/show/1033570 Factory / python310

Comment 6 Swamp Workflow Management 2022-11-15 20:34:42 UTC

SUSE-SU-2022:4004-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1204886,1205244
CVE References: CVE-2022-42919,CVE-2022-45061
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    python310-3.10.8-150400.4.15.1, python310-core-3.10.8-150400.4.15.1, python310-documentation-3.10.8-150400.4.15.1
SUSE Linux Enterprise Module for Python3 15-SP4 (src):    python310-3.10.8-150400.4.15.1, python310-core-3.10.8-150400.4.15.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 7 Swamp Workflow Management 2022-11-18 17:24:39 UTC

SUSE-SU-2022:4071-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1204886,1205244
CVE References: CVE-2022-42919,CVE-2022-45061
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    python39-3.9.15-150300.4.21.1, python39-core-3.9.15-150300.4.21.1, python39-documentation-3.9.15-150300.4.21.1
openSUSE Leap 15.3 (src):    python39-3.9.15-150300.4.21.1, python39-core-3.9.15-150300.4.21.1, python39-documentation-3.9.15-150300.4.21.1
SUSE Linux Enterprise Module for Development Tools 15-SP3 (src):    python39-core-3.9.15-150300.4.21.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    python39-3.9.15-150300.4.21.1, python39-core-3.9.15-150300.4.21.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.