Vulnerability in Polkit_project Polkit
CVE-2019-6133
In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polk…
Vulnerability class: Race Condition
EPSS: 0.004 (36.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Polkit_project Polkit — versions 0.115
- Canonical Ubuntu_linux — versions 12.04, 14.04, 16.04
- Debian Debian_linux — versions 8.0
- Redhat Enterprise_linux_desktop — versions 7.0, 6.0
- Redhat Enterprise_linux_server — versions 7.0, 6.0
- Redhat Enterprise_linux_server_aus — versions 7.6, 6.6
- Redhat Enterprise_linux_server_eus — versions 7.6
- Redhat Enterprise_linux_server_tus — versions 7.6
- Redhat Enterprise_linux_workstation — versions 7.0, 6.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Patch, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- cve@mitre.org (Patch, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- cve@mitre.org (Patch, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Mailing List, Third Party Advisory, x_refsource_MISC, Issue Tracking)
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-6133?
- CVE-2019-6133 is a medium-severity vulnerability in Polkit_project Polkit, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 6.7/10. Published 2019-01-11.
- How severe is CVE-2019-6133?
- Medium severity. CVSS v3 base score is 6.7 out of 10.