Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 2138705 (CVE-2022-42919) - CVE-2022-42919 python: local privilege escalation via the multiprocessing forkserver start method
Summary: CVE-2022-42919 python: local privilege escalation via the multiprocessing for...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-42919
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2138709 2138710 2138711 2138712 2138713 2138714 2138715 2138716 2138717 2138718 2138719 2138720 2138721
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-10-31 04:24 UTC by Sandipan Roy
Modified: 2023-09-22 13:29 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability found in Python. The flaw occurs when used with the forkserver start method on Linux. The Python multiprocessing library allows Python pickles to be deserialized from any user in the same machine's local network namespace in many system configurations, which means any user on the same machine. Pickles can execute arbitrary code. This flaw allows local user privilege escalation to the user that any Python multiprocessing forkserver process is running.
Clone Of:
Environment:
Last Closed: 2023-05-16 15:43:59 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2022:8517 0 None None None 2022-11-17 00:01:07 UTC
Red Hat Product Errata RHBA-2022:8519 0 None None None 2022-11-17 00:54:18 UTC
Red Hat Product Errata RHBA-2022:8606 0 None None None 2022-11-22 16:32:06 UTC
Red Hat Product Errata RHBA-2022:8607 0 None None None 2022-11-22 16:34:14 UTC
Red Hat Product Errata RHBA-2022:8611 0 None None None 2022-11-22 17:06:10 UTC
Red Hat Product Errata RHBA-2022:8613 0 None None None 2022-11-22 18:06:26 UTC
Red Hat Product Errata RHBA-2022:8630 0 None None None 2022-11-28 01:11:20 UTC
Red Hat Product Errata RHBA-2022:8631 0 None None None 2022-11-28 01:11:15 UTC
Red Hat Product Errata RHBA-2022:8632 0 None None None 2022-11-28 01:11:08 UTC
Red Hat Product Errata RHBA-2022:8636 0 None None None 2022-11-28 09:08:01 UTC
Red Hat Product Errata RHBA-2022:8642 0 None None None 2022-11-28 10:10:08 UTC
Red Hat Product Errata RHSA-2022:8492 0 None None None 2022-11-16 10:28:52 UTC
Red Hat Product Errata RHSA-2022:8493 0 None None None 2022-11-16 10:37:28 UTC

Description Sandipan Roy 2022-10-31 04:24:39 UTC
CVE-2022-42919:

Python 3.9, 3.10, and 3.11.0rc2 on Linux may allow for a local privilege escalation attack in a non-default configuration when code uses the multiprocessing module and configures multiprocessing to use the forkserver start method.

Reference:
https://github.com/python/cpython/issues/97514

Comment 1 Sandipan Roy 2022-10-31 04:35:58 UTC
Created pypy3.9 tracking bugs for this issue:

Affects: fedora-all [bug 2138712]


Created python3.10 tracking bugs for this issue:

Affects: fedora-all [bug 2138709]


Created python3.11 tracking bugs for this issue:

Affects: fedora-all [bug 2138710]


Created python3.9 tracking bugs for this issue:

Affects: fedora-all [bug 2138711]

Comment 3 Lumír Balhar 2022-11-07 11:08:48 UTC
I'd like to create a reproducer for this issue but I'm afraid it's far from easy.

Comment 4 errata-xmlrpc 2022-11-16 10:28:51 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support
  Red Hat Enterprise Linux 8
  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2022:8492 https://access.redhat.com/errata/RHSA-2022:8492

Comment 5 errata-xmlrpc 2022-11-16 10:37:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support
  Red Hat Enterprise Linux 9

Via RHSA-2022:8493 https://access.redhat.com/errata/RHSA-2022:8493

Comment 6 Fedora Update System 2022-11-23 01:15:59 UTC
FEDORA-2022-a7cad6bd22 has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 7 Product Security DevOps Team 2023-05-16 15:43:56 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-42919


Note You need to log in before you can comment on or make changes to this bug.