Bug 2138705 (CVE-2022-42919) - CVE-2022-42919 python: local privilege escalation via the multiprocessing forkserver start method
Summary: CVE-2022-42919 python: local privilege escalation via the multiprocessing for...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-42919
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2138709 2138710 2138711 2138712 2138713 2138714 2138715 2138716 2138717 2138718 2138719 2138720 2138721
Blocks: 2138257
TreeView+ depends on / blocked
 
Reported: 2022-10-31 04:24 UTC by Sandipan Roy
Modified: 2023-09-22 13:29 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability found in Python. The flaw occurs when used with the forkserver start method on Linux. The Python multiprocessing library allows Python pickles to be deserialized from any user in the same machine's local network namespace in many system configurations, which means any user on the same machine. Pickles can execute arbitrary code. This flaw allows local user privilege escalation to the user that any Python multiprocessing forkserver process is running.
Clone Of:
Environment:
Last Closed: 2023-05-16 15:43:59 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2022:8517 0 None None None 2022-11-17 00:01:07 UTC
Red Hat Product Errata RHBA-2022:8519 0 None None None 2022-11-17 00:54:18 UTC
Red Hat Product Errata RHBA-2022:8606 0 None None None 2022-11-22 16:32:06 UTC
Red Hat Product Errata RHBA-2022:8607 0 None None None 2022-11-22 16:34:14 UTC
Red Hat Product Errata RHBA-2022:8611 0 None None None 2022-11-22 17:06:10 UTC
Red Hat Product Errata RHBA-2022:8613 0 None None None 2022-11-22 18:06:26 UTC
Red Hat Product Errata RHBA-2022:8630 0 None None None 2022-11-28 01:11:20 UTC
Red Hat Product Errata RHBA-2022:8631 0 None None None 2022-11-28 01:11:15 UTC
Red Hat Product Errata RHBA-2022:8632 0 None None None 2022-11-28 01:11:08 UTC
Red Hat Product Errata RHBA-2022:8636 0 None None None 2022-11-28 09:08:01 UTC
Red Hat Product Errata RHBA-2022:8642 0 None None None 2022-11-28 10:10:08 UTC
Red Hat Product Errata RHSA-2022:8492 0 None None None 2022-11-16 10:28:52 UTC
Red Hat Product Errata RHSA-2022:8493 0 None None None 2022-11-16 10:37:28 UTC

Description Sandipan Roy 2022-10-31 04:24:39 UTC 
CVE-2022-42919:

Python 3.9, 3.10, and 3.11.0rc2 on Linux may allow for a local privilege escalation attack in a non-default configuration when code uses the multiprocessing module and configures multiprocessing to use the forkserver start method.

Reference:
https://github.com/python/cpython/issues/97514
Comment 1 Sandipan Roy 2022-10-31 04:35:58 UTC 
Created pypy3.9 tracking bugs for this issue:

Affects: fedora-all [bug 2138712]


Created python3.10 tracking bugs for this issue:

Affects: fedora-all [bug 2138709]


Created python3.11 tracking bugs for this issue:

Affects: fedora-all [bug 2138710]


Created python3.9 tracking bugs for this issue:

Affects: fedora-all [bug 2138711]
Comment 3 Lumír Balhar 2022-11-07 11:08:48 UTC 
I'd like to create a reproducer for this issue but I'm afraid it's far from easy.
Comment 4 errata-xmlrpc 2022-11-16 10:28:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support
  Red Hat Enterprise Linux 8
  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2022:8492 https://access.redhat.com/errata/RHSA-2022:8492
Comment 5 errata-xmlrpc 2022-11-16 10:37:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support
  Red Hat Enterprise Linux 9

Via RHSA-2022:8493 https://access.redhat.com/errata/RHSA-2022:8493
Comment 6 Fedora Update System 2022-11-23 01:15:59 UTC 
FEDORA-2022-a7cad6bd22 has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 7 Product Security DevOps Team 2023-05-16 15:43:56 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-42919
Note You need to log in before you can comment on or make changes to this bug.