Bug 1204886 – VUL-0: CVE-2022-42919: python39,python310: python: local privilege escalation via the multiprocessing forkserver start method

Bug 1204886 - (CVE-2022-42919) VUL-0: CVE-2022-42919: python39,python310: python: local privilege escalation via the multiprocessing forkserver start method

(CVE-2022-42919)
Summary:	VUL-0: CVE-2022-42919: python39,python310: python: local privilege escalation...

Status:	IN_PROGRESS

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Major
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/346621/
Whiteboard:	CVSSv3.1:SUSE:CVE-2022-42919:7.8:(AV...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2022-10-31 10:27 UTC by Thomas Leroy
Modified:	2022-11-18 17:24 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Thomas Leroy 2022-10-31 10:27:29 UTC

rh#2138705

CVE-2022-42919:

Python 3.9, 3.10, and 3.11.0rc2 on Linux may allow for a local privilege escalation attack in a non-default configuration when code uses the multiprocessing module and configures multiprocessing to use the forkserver start method.

Reference:
https://github.com/python/cpython/issues/97514

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2138705
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-42919

Comment 1 Thomas Leroy 2022-10-31 10:30:03 UTC

The abstract socket support to communicate with the forkserver was added in 3.7.8 and 3.8.4. Therefore, only the following are affected:
- SUSE:SLE-15-SP4:Update/python310
- SUSE:SLE-15-SP3:Update/python39

Comment 2 OBSbugzilla Bot 2022-11-04 15:35:08 UTC

This is an autogenerated message for OBS integration:
This bug (1204886) was mentioned in
https://build.opensuse.org/request/show/1033552 Factory / python39

Comment 3 OBSbugzilla Bot 2022-11-04 17:35:03 UTC

This is an autogenerated message for OBS integration:
This bug (1204886) was mentioned in
https://build.opensuse.org/request/show/1033570 Factory / python310

Comment 6 Swamp Workflow Management 2022-11-15 20:34:42 UTC

SUSE-SU-2022:4004-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1204886,1205244
CVE References: CVE-2022-42919,CVE-2022-45061
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    python310-3.10.8-150400.4.15.1, python310-core-3.10.8-150400.4.15.1, python310-documentation-3.10.8-150400.4.15.1
SUSE Linux Enterprise Module for Python3 15-SP4 (src):    python310-3.10.8-150400.4.15.1, python310-core-3.10.8-150400.4.15.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 7 Swamp Workflow Management 2022-11-18 17:24:39 UTC

SUSE-SU-2022:4071-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1204886,1205244
CVE References: CVE-2022-42919,CVE-2022-45061
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    python39-3.9.15-150300.4.21.1, python39-core-3.9.15-150300.4.21.1, python39-documentation-3.9.15-150300.4.21.1
openSUSE Leap 15.3 (src):    python39-3.9.15-150300.4.21.1, python39-core-3.9.15-150300.4.21.1, python39-documentation-3.9.15-150300.4.21.1
SUSE Linux Enterprise Module for Development Tools 15-SP3 (src):    python39-core-3.9.15-150300.4.21.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    python39-3.9.15-150300.4.21.1, python39-core-3.9.15-150300.4.21.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.