Bug 1217939 (CVE-2023-6507) - VUL-0: CVE-2023-6507: python3: possible privilege escalation in subprocess
Summary: VUL-0: CVE-2023-6507: python3: possible privilege escalation in subprocess
Status: RESOLVED UPSTREAM
Alias: CVE-2023-6507
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/387470/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-12-11 11:03 UTC by SMASH SMASH
Modified: 2023-12-15 13:35 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2023-12-11 11:03:18 UTC 
An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases.

When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list.

This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).



References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-6507
Comment 1 Gabriele Sonnu 2023-12-11 11:04:31 UTC 
Only affects python3.12 and up, and we only ship up to python 3.11.

Closing this.
Comment 3 OBSbugzilla Bot 2023-12-15 13:35:03 UTC 
This is an autogenerated message for OBS integration:
This bug (1217939) was mentioned in
https://build.opensuse.org/request/show/1133398 Factory / python312