Bug 1121826 – VUL-0: CVE-2019-6133: polkit,PolicyKit: In PolicyKit (aka polkit) , the "start time" protection mechanism can be bypassed and therefore authorization decisions are improperly cached

Bug 1121826 - (CVE-2019-6133) VUL-0: CVE-2019-6133: polkit,PolicyKit: In PolicyKit (aka polkit) , the "start time" protection mechanism can be bypassed and therefore authorization decisions are improperly cached

(CVE-2019-6133)
Summary:	VUL-0: CVE-2019-6133: polkit,PolicyKit: In PolicyKit (aka polkit) , the "star...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Major
Target Milestone:	---
Assigned To:	Marcus Meissner
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/222701/
Whiteboard:	CVSSv3:RedHat:CVE-2019-6133:7.3:(AV:L...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2019-01-14 10:59 UTC by Alexandros Toptsoglou
Modified:	2022-03-02 15:48 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Alexandros Toptsoglou 2019-01-14 10:59:44 UTC

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be
bypassed because fork() is not atomic, and therefore authorization decisions are
improperly cached. This is related to lack of uid checking in
polkitbackend/polkitbackendinteractiveauthority.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6133
http://www.cvedetails.com/cve/CVE-2019-6133/
https://git.kernel.org/linus/7b55851367136b1efd84d98fea81ba57a98304cf
https://gitlab.freedesktop.org/polkit/polkit/commit/c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81
https://gitlab.freedesktop.org/polkit/polkit/merge_requests/19
https://bugs.chromium.org/p/project-zero/issues/detail?id=1692

Comment 1 Alexandros Toptsoglou 2019-01-14 11:05:50 UTC

SLE 12 and SLE 15 are affected. A fix already exists in [1]. An alternative fix in kernel is available at [2]. A poc is located at [3] with information how to run it in [4]. Pay attention according to [4] the poc may not work all the time. 

[1] https://gitlab.freedesktop.org/polkit/polkit/commit/c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81

[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7b55851367136b1efd84d98fea81ba57a98304cf

[3] https://bugs.chromium.org/p/project-zero/issues/attachment?aid=362437&signed_aid=OBpZQxt0cqmZ1SZz7r42MQ==

[4] https://bugs.chromium.org/p/project-zero/issues/detail?id=1692

Comment 4 Marcus Meissner 2019-07-26 12:36:02 UTC

sle11 is quite different, I would need to wrap my head around it :/

Comment 5 Swamp Workflow Management 2019-07-30 16:16:47 UTC

SUSE-SU-2019:2018-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1121826
CVE References: CVE-2019-6133
Sources used:
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    polkit-0.114-3.9.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    polkit-0.114-3.9.1
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    polkit-0.114-3.9.1
SUSE Linux Enterprise Module for Basesystem 15 (src):    polkit-0.114-3.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 6 Swamp Workflow Management 2019-08-01 19:15:04 UTC

SUSE-SU-2019:2035-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1121826
CVE References: CVE-2019-6133
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    polkit-0.113-5.18.1
SUSE OpenStack Cloud 8 (src):    polkit-0.113-5.18.1
SUSE OpenStack Cloud 7 (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Workstation Extension 12-SP5 (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Workstation Extension 12-SP4 (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Server 12-SP5 (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Server 12-SP4 (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Desktop 12-SP5 (src):    polkit-0.113-5.18.1
SUSE Linux Enterprise Desktop 12-SP4 (src):    polkit-0.113-5.18.1
SUSE Enterprise Storage 5 (src):    polkit-0.113-5.18.1
SUSE Enterprise Storage 4 (src):    polkit-0.113-5.18.1
HPE Helion Openstack 8 (src):    polkit-0.113-5.18.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 7 Swamp Workflow Management 2019-08-15 13:27:04 UTC

openSUSE-SU-2019:1914-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1121826
CVE References: CVE-2019-6133
Sources used:
openSUSE Leap 15.1 (src):    polkit-0.114-lp151.5.3.1
openSUSE Leap 15.0 (src):    polkit-0.114-lp150.2.10.1

Comment 8 Swamp Workflow Management 2019-08-16 22:11:19 UTC

SUSE-SU-2019:2035-2: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1121826
CVE References: CVE-2019-6133
Sources used:
SUSE Enterprise Storage 5 (src):    polkit-0.113-5.18.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 10 Swamp Workflow Management 2020-11-24 17:22:50 UTC

SUSE-SU-2020:3503-1: An update that solves 21 vulnerabilities and has 21 fixes is now available.

Category: security (important)
Bug References: 1065600,1083244,1121826,1121872,1157298,1160917,1170415,1175228,1175306,1175721,1175749,1176011,1176069,1176235,1176253,1176278,1176381,1176382,1176423,1176482,1176721,1176722,1176725,1176816,1176896,1176990,1177027,1177086,1177121,1177165,1177206,1177226,1177410,1177411,1177511,1177513,1177725,1177766,1177816,1178123,1178622,1178782
CVE References: CVE-2017-18204,CVE-2019-19063,CVE-2019-6133,CVE-2020-0404,CVE-2020-0427,CVE-2020-0431,CVE-2020-0432,CVE-2020-12352,CVE-2020-14351,CVE-2020-14381,CVE-2020-14390,CVE-2020-25212,CVE-2020-25284,CVE-2020-25641,CVE-2020-25643,CVE-2020-25645,CVE-2020-25656,CVE-2020-25668,CVE-2020-25705,CVE-2020-26088,CVE-2020-8694
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    kernel-default-4.4.180-94.135.1, kernel-source-4.4.180-94.135.1, kernel-syms-4.4.180-94.135.1, kgraft-patch-SLE12-SP3_Update_36-1-4.5.1
SUSE OpenStack Cloud 8 (src):    kernel-default-4.4.180-94.135.1, kernel-source-4.4.180-94.135.1, kernel-syms-4.4.180-94.135.1, kgraft-patch-SLE12-SP3_Update_36-1-4.5.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    kernel-default-4.4.180-94.135.1, kernel-source-4.4.180-94.135.1, kernel-syms-4.4.180-94.135.1, kgraft-patch-SLE12-SP3_Update_36-1-4.5.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    kernel-default-4.4.180-94.135.1, kernel-source-4.4.180-94.135.1, kernel-syms-4.4.180-94.135.1, kgraft-patch-SLE12-SP3_Update_36-1-4.5.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    kernel-default-4.4.180-94.135.1, kernel-source-4.4.180-94.135.1, kernel-syms-4.4.180-94.135.1
SUSE Linux Enterprise High Availability 12-SP3 (src):    kernel-default-4.4.180-94.135.1
SUSE Enterprise Storage 5 (src):    kernel-default-4.4.180-94.135.1, kernel-source-4.4.180-94.135.1, kernel-syms-4.4.180-94.135.1, kgraft-patch-SLE12-SP3_Update_36-1-4.5.1
HPE Helion Openstack 8 (src):    kernel-default-4.4.180-94.135.1, kernel-source-4.4.180-94.135.1, kernel-syms-4.4.180-94.135.1, kgraft-patch-SLE12-SP3_Update_36-1-4.5.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Swamp Workflow Management 2021-02-11 20:19:21 UTC

SUSE-SU-2021:0437-1: An update that solves 26 vulnerabilities and has 16 fixes is now available.

Category: security (important)
Bug References: 1070943,1121826,1121872,1157298,1168952,1173942,1176395,1176485,1177411,1178123,1178182,1178589,1178622,1178886,1179107,1179140,1179141,1179204,1179419,1179508,1179509,1179601,1179616,1179663,1179666,1179745,1179877,1179960,1179961,1180008,1180027,1180028,1180029,1180030,1180031,1180032,1180052,1180086,1180559,1180562,1181349,969755
CVE References: CVE-2019-19063,CVE-2019-20934,CVE-2019-6133,CVE-2020-0444,CVE-2020-0465,CVE-2020-0466,CVE-2020-11668,CVE-2020-15436,CVE-2020-15437,CVE-2020-25211,CVE-2020-25285,CVE-2020-25668,CVE-2020-25669,CVE-2020-27068,CVE-2020-27673,CVE-2020-27777,CVE-2020-27786,CVE-2020-27825,CVE-2020-28915,CVE-2020-28974,CVE-2020-29568,CVE-2020-29569,CVE-2020-29660,CVE-2020-29661,CVE-2020-36158,CVE-2021-3347
JIRA References: 
Sources used:
SUSE OpenStack Cloud 7 (src):    kernel-default-4.4.121-92.149.1, kernel-source-4.4.121-92.149.1, kernel-syms-4.4.121-92.149.1, kgraft-patch-SLE12-SP2_Update_39-1-3.3.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    kernel-default-4.4.121-92.149.1, kernel-source-4.4.121-92.149.1, kernel-syms-4.4.121-92.149.1, kgraft-patch-SLE12-SP2_Update_39-1-3.3.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    kernel-default-4.4.121-92.149.1, kernel-source-4.4.121-92.149.1, kernel-syms-4.4.121-92.149.1, kgraft-patch-SLE12-SP2_Update_39-1-3.3.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    kernel-default-4.4.121-92.149.1, kernel-source-4.4.121-92.149.1, kernel-syms-4.4.121-92.149.1
SUSE Linux Enterprise High Availability 12-SP2 (src):    kernel-default-4.4.121-92.149.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 12 Marcus Meissner 2022-03-02 15:48:41 UTC

PolicyKit on SLE11 not cnsidered to be affected