Bug 2138705 (CVE-2022-42919)

Summary:	CVE-2022-42919 python: local privilege escalation via the multiprocessing forkserver start method
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	cstratak, hhorak, jorton, lbalhar, python-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability found in Python. The flaw occurs when used with the forkserver start method on Linux. The Python multiprocessing library allows Python pickles to be deserialized from any user in the same machine's local network namespace in many system configurations, which means any user on the same machine. Pickles can execute arbitrary code. This flaw allows local user privilege escalation to the user that any Python multiprocessing forkserver process is running.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-16 15:43:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2138709, 2138710, 2138711, 2138712, 2138713, 2138714, 2138715, 2138716, 2138717, 2138718, 2138719, 2138720, 2138721
Bug Blocks:	2138257

Description Sandipan Roy 2022-10-31 04:24:39 UTC

CVE-2022-42919:

Python 3.9, 3.10, and 3.11.0rc2 on Linux may allow for a local privilege escalation attack in a non-default configuration when code uses the multiprocessing module and configures multiprocessing to use the forkserver start method.

Reference:
https://github.com/python/cpython/issues/97514

Comment 1 Sandipan Roy 2022-10-31 04:35:58 UTC

Created pypy3.9 tracking bugs for this issue:

Affects: fedora-all [bug 2138712]


Created python3.10 tracking bugs for this issue:

Affects: fedora-all [bug 2138709]


Created python3.11 tracking bugs for this issue:

Affects: fedora-all [bug 2138710]


Created python3.9 tracking bugs for this issue:

Affects: fedora-all [bug 2138711]

Comment 3 Lumír Balhar 2022-11-07 11:08:48 UTC

I'd like to create a reproducer for this issue but I'm afraid it's far from easy.

Comment 4 errata-xmlrpc 2022-11-16 10:28:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support
  Red Hat Enterprise Linux 8
  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2022:8492 https://access.redhat.com/errata/RHSA-2022:8492

Comment 5 errata-xmlrpc 2022-11-16 10:37:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support
  Red Hat Enterprise Linux 9

Via RHSA-2022:8493 https://access.redhat.com/errata/RHSA-2022:8493

Comment 6 Fedora Update System 2022-11-23 01:15:59 UTC

FEDORA-2022-a7cad6bd22 has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 7 Product Security DevOps Team 2023-05-16 15:43:56 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-42919