Bug 1441584 (CVE-2017-7572) - CVE-2017-7572 backintime: Race condition in the checkPolkitPrivilege function
Summary: CVE-2017-7572 backintime: Race condition in the checkPolkitPrivilege function
Keywords:
Status: CLOSED RAWHIDE
Alias: CVE-2017-7572
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1441585
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-04-12 09:17 UTC by Andrej Nemec
Modified: 2019-09-29 14:09 UTC (History)
3 users (show)

Fixed In Version: backintime 1.1.20
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-05-06 07:23:48 UTC
Embargoed:

Attachments (Terms of Use)

Description Andrej Nemec 2017-04-12 09:17:43 UTC 
The _checkPolkitPrivilege function in serviceHelper.py in Back In Time (aka backintime) 1.1.18 and earlier uses a deprecated polkit authorization method (unix-process) that is subject to a race condition (time of check, time of use). With this authorization method, the owner of a process requesting a polkit operation is checked by polkitd via /proc/<pid>/status, by which time the requesting process may have been replaced by a different process with the same PID that has different privileges then the original requester. 

Upstream patch:

https://github.com/bit-team/backintime/commit/7f208dc547f569b689c888103e3b593a48cd1869

References:

https://github.com/bit-team/backintime/releases/tag/v1.1.20
Comment 1 Andrej Nemec 2017-04-12 09:18:14 UTC 
Created backintime tracking bugs for this issue:

Affects: fedora-all [bug 1441585]
Comment 2 Raphael Groner 2018-04-06 19:55:45 UTC 
Bug 1441585 is closed, so can we close here as well?
Note You need to log in before you can comment on or make changes to this bug.