CVE-2019-6133

NameCVE-2019-6133
DescriptionIn PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1644-1, DLA-1799-1, ELA-127-1
Debian Bugs918985

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)jessie, jessie (lts)3.16.84-1fixed
stretch (security)4.9.320-2fixed
stretch (lts), stretch4.9.320-3fixed
buster (security), buster, buster (lts)4.19.316-1fixed
bullseye5.10.223-1fixed
bullseye (security)5.10.226-1fixed
bookworm6.1.106-3fixed
bookworm (security)6.1.112-1fixed
trixie6.10.11-1fixed
sid6.11.2-1fixed
policykit-1 (PTS)jessie, jessie (lts)0.105-15~deb8u5fixed
stretch (security), stretch (lts), stretch0.105-18+deb9u2vulnerable
buster (security), buster, buster (lts)0.105-25+deb10u1fixed
bullseye (security), bullseye0.105-31+deb11u1fixed
bookworm122-3fixed
sid, trixie125-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsourcewheezy(unfixed)end-of-life
linuxsourcejessie3.16.68-1DLA-1799-1
linuxsourcestretch4.9.161-1
linuxsource(unstable)4.19.16-1
policykit-1sourcewheezy(unfixed)end-of-life
policykit-1sourcejessie0.105-15~deb8u4DLA-1644-1
policykit-1source(unstable)0.105-25918985

Notes

[stretch] - policykit-1 <no-dsa> (Minor issue, kernel mitigation will land in next 4.9.x rebase)
https://bugs.chromium.org/p/project-zero/issues/detail?id=1692
https://gitlab.freedesktop.org/polkit/polkit/merge_requests/19
https://gitlab.freedesktop.org/polkit/polkit/commit/c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81
Issue can be mitigated in kernel with
https://git.kernel.org/linus/7b55851367136b1efd84d98fea81ba57a98304cf (landed in 4.9.150)

Search for package or bug name: Reporting problems