NetSight
IP …
medium6.7

CVE-2019-6133

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are …

Impact

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

Affected products

VendorProductAffected versions
Polkit ProjectPolkit
Version 0.115
DebianDebian Linux
Version 8.0
RedhatEnterprise Linux Desktop
Versions 7.0, 6.0
RedhatEnterprise Linux Server
Versions 7.0, 6.0
RedhatEnterprise Linux Server Aus
Versions 7.6, 6.6
RedhatEnterprise Linux Server Eus
Version 7.6
RedhatEnterprise Linux Server Tus
Version 7.6
RedhatEnterprise Linux Workstation
Versions 7.0, 6.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04, 18.10

Weakness classification

CWE-362

References