Bug 1121872 – VUL-0: CVE-2019-6133: kernel-source: In PolicyKit (aka polkit) , the "start time" protection mechanism can be bypassed and therefore authorization decisions are improperly cached

Bug 1121872 - VUL-0: CVE-2019-6133: kernel-source: In PolicyKit (aka polkit) , the "start time" protection mechanism can be bypassed and therefore authorization decisions are improperly cached


Summary:	VUL-0: CVE-2019-6133: kernel-source: In PolicyKit (aka polkit) , the "start t...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Major
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/222701/
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2019-01-14 14:49 UTC by Marcus Meissner
Modified:	2022-06-09 08:25 UTC (History)
CC List:	6 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Marcus Meissner 2019-01-14 14:49:51 UTC

The problem exposed by policy kit has also a kernel hardening fix.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7b55851367136b1efd84d98fea81ba57a98304cf

which we could backport.

+++ This bug was initially created as a clone of Bug #1121826 +++

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be
bypassed because fork() is not atomic, and therefore authorization decisions are
improperly cached. This is related to lack of uid checking in
polkitbackend/polkitbackendinteractiveauthority.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6133
http://www.cvedetails.com/cve/CVE-2019-6133/
https://git.kernel.org/linus/7b55851367136b1efd84d98fea81ba57a98304cf
https://gitlab.freedesktop.org/polkit/polkit/commit/c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81
https://gitlab.freedesktop.org/polkit/polkit/merge_requests/19
https://bugs.chromium.org/p/project-zero/issues/detail?id=1692

Comment 1 Michal Hocko 2019-01-14 15:11:45 UTC

OK, the patch makes sense and looks like a good measure to have in general.

Comment 7 Swamp Workflow Management 2019-03-19 10:19:13 UTC

SUSE-SU-2019:13979-1: An update that solves 8 vulnerabilities and has 73 fixes is now available.

Category: security (important)
Bug References: 1012382,1031572,1068032,1086695,1087081,1094244,1098658,1104098,1104367,1104684,1104818,1105536,1106105,1106886,1107371,1109330,1109806,1110006,1112963,1113667,1114440,1114672,1114920,1115007,1115038,1115827,1115828,1115829,1115830,1115831,1115832,1115833,1115834,1115835,1115836,1115837,1115838,1115839,1115840,1115841,1115842,1115843,1115844,1116841,1117796,1117802,1117805,1117806,1117943,1118152,1118319,1118760,1119255,1119714,1120056,1120077,1120086,1120093,1120094,1120105,1120107,1120109,1120217,1120223,1120226,1120336,1120347,1120743,1120950,1121872,1121997,1122874,1123505,1123702,1123706,1124010,1124735,1125931,931850,969471,969473
CVE References: CVE-2016-10741,CVE-2017-18360,CVE-2018-19407,CVE-2018-19824,CVE-2018-19985,CVE-2018-20169,CVE-2018-9568,CVE-2019-7222
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    kernel-docs-3.0.101-108.87.1
SUSE Linux Enterprise Server 11-SP4 (src):    kernel-bigmem-3.0.101-108.87.1, kernel-default-3.0.101-108.87.1, kernel-ec2-3.0.101-108.87.1, kernel-pae-3.0.101-108.87.1, kernel-ppc64-3.0.101-108.87.1, kernel-source-3.0.101-108.87.1, kernel-syms-3.0.101-108.87.1, kernel-trace-3.0.101-108.87.1, kernel-xen-3.0.101-108.87.1
SUSE Linux Enterprise Server 11-EXTRA (src):    kernel-default-3.0.101-108.87.1, kernel-pae-3.0.101-108.87.1, kernel-ppc64-3.0.101-108.87.1, kernel-trace-3.0.101-108.87.1, kernel-xen-3.0.101-108.87.1
SUSE Linux Enterprise Real Time Extension 11-SP4 (src):    ocfs2-1.6-0.28.7.1
SUSE Linux Enterprise High Availability Extension 11-SP4 (src):    ocfs2-1.6-0.28.7.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    kernel-bigmem-3.0.101-108.87.1, kernel-default-3.0.101-108.87.1, kernel-ec2-3.0.101-108.87.1, kernel-pae-3.0.101-108.87.1, kernel-ppc64-3.0.101-108.87.1, kernel-trace-3.0.101-108.87.1, kernel-xen-3.0.101-108.87.1

Comment 8 Marcus Meissner 2019-11-02 09:18:29 UTC

released

Comment 13 Jessica Yu 2020-11-12 09:57:16 UTC

Pushed pull requests to cve/linux-4.4, cve/linux-3.0, cve/linux-2.6.32, patch already exists in cve/linux-4.12. That should cover the branches mentioned in comment#9 and comment#10.

Comment 16 Swamp Workflow Management 2020-11-24 17:22:55 UTC

SUSE-SU-2020:3503-1: An update that solves 21 vulnerabilities and has 21 fixes is now available.

Category: security (important)
Bug References: 1065600,1083244,1121826,1121872,1157298,1160917,1170415,1175228,1175306,1175721,1175749,1176011,1176069,1176235,1176253,1176278,1176381,1176382,1176423,1176482,1176721,1176722,1176725,1176816,1176896,1176990,1177027,1177086,1177121,1177165,1177206,1177226,1177410,1177411,1177511,1177513,1177725,1177766,1177816,1178123,1178622,1178782
CVE References: CVE-2017-18204,CVE-2019-19063,CVE-2019-6133,CVE-2020-0404,CVE-2020-0427,CVE-2020-0431,CVE-2020-0432,CVE-2020-12352,CVE-2020-14351,CVE-2020-14381,CVE-2020-14390,CVE-2020-25212,CVE-2020-25284,CVE-2020-25641,CVE-2020-25643,CVE-2020-25645,CVE-2020-25656,CVE-2020-25668,CVE-2020-25705,CVE-2020-26088,CVE-2020-8694
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    kernel-default-4.4.180-94.135.1, kernel-source-4.4.180-94.135.1, kernel-syms-4.4.180-94.135.1, kgraft-patch-SLE12-SP3_Update_36-1-4.5.1
SUSE OpenStack Cloud 8 (src):    kernel-default-4.4.180-94.135.1, kernel-source-4.4.180-94.135.1, kernel-syms-4.4.180-94.135.1, kgraft-patch-SLE12-SP3_Update_36-1-4.5.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    kernel-default-4.4.180-94.135.1, kernel-source-4.4.180-94.135.1, kernel-syms-4.4.180-94.135.1, kgraft-patch-SLE12-SP3_Update_36-1-4.5.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    kernel-default-4.4.180-94.135.1, kernel-source-4.4.180-94.135.1, kernel-syms-4.4.180-94.135.1, kgraft-patch-SLE12-SP3_Update_36-1-4.5.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    kernel-default-4.4.180-94.135.1, kernel-source-4.4.180-94.135.1, kernel-syms-4.4.180-94.135.1
SUSE Linux Enterprise High Availability 12-SP3 (src):    kernel-default-4.4.180-94.135.1
SUSE Enterprise Storage 5 (src):    kernel-default-4.4.180-94.135.1, kernel-source-4.4.180-94.135.1, kernel-syms-4.4.180-94.135.1, kgraft-patch-SLE12-SP3_Update_36-1-4.5.1
HPE Helion Openstack 8 (src):    kernel-default-4.4.180-94.135.1, kernel-source-4.4.180-94.135.1, kernel-syms-4.4.180-94.135.1, kgraft-patch-SLE12-SP3_Update_36-1-4.5.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 22 Swamp Workflow Management 2021-02-11 20:19:27 UTC

SUSE-SU-2021:0437-1: An update that solves 26 vulnerabilities and has 16 fixes is now available.

Category: security (important)
Bug References: 1070943,1121826,1121872,1157298,1168952,1173942,1176395,1176485,1177411,1178123,1178182,1178589,1178622,1178886,1179107,1179140,1179141,1179204,1179419,1179508,1179509,1179601,1179616,1179663,1179666,1179745,1179877,1179960,1179961,1180008,1180027,1180028,1180029,1180030,1180031,1180032,1180052,1180086,1180559,1180562,1181349,969755
CVE References: CVE-2019-19063,CVE-2019-20934,CVE-2019-6133,CVE-2020-0444,CVE-2020-0465,CVE-2020-0466,CVE-2020-11668,CVE-2020-15436,CVE-2020-15437,CVE-2020-25211,CVE-2020-25285,CVE-2020-25668,CVE-2020-25669,CVE-2020-27068,CVE-2020-27673,CVE-2020-27777,CVE-2020-27786,CVE-2020-27825,CVE-2020-28915,CVE-2020-28974,CVE-2020-29568,CVE-2020-29569,CVE-2020-29660,CVE-2020-29661,CVE-2020-36158,CVE-2021-3347
JIRA References: 
Sources used:
SUSE OpenStack Cloud 7 (src):    kernel-default-4.4.121-92.149.1, kernel-source-4.4.121-92.149.1, kernel-syms-4.4.121-92.149.1, kgraft-patch-SLE12-SP2_Update_39-1-3.3.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    kernel-default-4.4.121-92.149.1, kernel-source-4.4.121-92.149.1, kernel-syms-4.4.121-92.149.1, kgraft-patch-SLE12-SP2_Update_39-1-3.3.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    kernel-default-4.4.121-92.149.1, kernel-source-4.4.121-92.149.1, kernel-syms-4.4.121-92.149.1, kgraft-patch-SLE12-SP2_Update_39-1-3.3.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    kernel-default-4.4.121-92.149.1, kernel-source-4.4.121-92.149.1, kernel-syms-4.4.121-92.149.1
SUSE Linux Enterprise High Availability 12-SP2 (src):    kernel-default-4.4.121-92.149.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 23 Carlos López 2022-06-09 08:25:50 UTC

Done, closing.