CVE-2019-6133: canonical ubuntu_linux Race Condition

CVSS: 6.7v3.0MediumModified

AliasesALPINE-CVE-2019-6133SUSE-SU-2019:2018-1SUSE-SU-2019:2035-1+11 more

Published 11-01-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-6133 is a medium (CVSS 6.7) Race Condition vulnerability in canonical ubuntu_linux. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.4% of scored vulnerabilities.

Overall risk

27/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.7/10

010

Medium · v3.0 (NVD)

EPSS score

0.45%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 8

DLA-1644-1 DLA-1799-1 OPENSUSE-SU-2024:11180-1 SUSE-SU-2020:3503-1 SUSE-SU-2021:0437-1 USN-3901-1+4 more

Timeline

11-01-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.06.7v2.04.4

EPSS trend

Probability

0.45%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

0.00 pp

From 0.45% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.45%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Ubuntu25 products

linux< 4.4.0-143.169 | < 4.15.0-46.49 | < 3.13.0-166.216
linux-aws< 4.4.0-1039.42 | < 4.4.0-1077.87 | < 4.15.0-1033.35
linux-aws-hwe< 4.15.0-1033.35~16.04.1
linux-azure< 4.15.0-1040.44~14.04.1 | < 4.15.0-1040.44 | < 4.18.0-1013.13~18.04.1
linux-azure-6.11All versions (No fix recorded)

Show all 25

Suse21 products

polkit&distro=HPE Helion OpenStack 8< 0.113-5.18.1
polkit&distro=SUSE Enterprise Storage 4< 0.113-5.18.1
polkit&distro=SUSE Enterprise Storage 5< 0.113-5.18.1
polkit&distro=SUSE Linux Enterprise Desktop 12 SP4< 0.113-5.18.1
polkit&distro=SUSE Linux Enterprise Module for Basesystem 15< 0.114-3.9.1

Show all 21

Redhat11 products

Show all 11

Debian3 products

linux< 4.19.16-1
policykit-1< 0.105-25
debian_linuxEOL8.0

Opensuse2 products

polkit&distro=openSUSE Leap 15.0< 0.114-lp151.5.3.1
polkit&distro=openSUSE Leap 15.1< 0.114-lp151.5.3.1

Alpine1 product

polkit< 0.105-r10 | < 0.105-r11

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 18.10

Polkit_project1 product

polkit0.115

8 vendors · 65 products

References

54 links

gitlab.freedesktop.org/polkit/polkit/commit/c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81X Refsource MISCPatchThird Party Advisory
usn.ubuntu.com/3903-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
access.redhat.com/errata/RHSA-2019:0230Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
git.kernel.org/linus/7b55851367136b1efd84d98fea81ba57a98304cfX Refsource MISCREPORTPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2019/01/msg00021.htmlMailing ListX Refsource MLISTThird Party Advisory
usn.ubuntu.com/3910-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
usn.ubuntu.com/3901-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
gitlab.freedesktop.org/polkit/polkit/merge_requests/19X Refsource MISCREPORTPatchThird Party Advisory
bugs.chromium.org/p/project-zero/issues/detail?id=1692X Refsource MISCARTICLEIssue TrackingMailing ListThird Party Advisory
usn.ubuntu.com/3910-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory

Show all 54 references

access.redhat.com/errata/RHSA-2019:0420Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
usn.ubuntu.com/3908-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
usn.ubuntu.com/3901-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
usn.ubuntu.com/3903-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.securityfocus.com/bid/106537VDB EntryX Refsource BIDThird Party Advisory
usn.ubuntu.com/3908-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
support.f5.com/csp/article/K22715344X Refsource CONFIRMThird Party Advisory
usn.ubuntu.com/3934-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
access.redhat.com/errata/RHSA-2019:0832Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
lists.debian.org/debian-lts-announce/2019/05/msg00041.htmlMailing ListX Refsource MLIST
lists.debian.org/debian-lts-announce/2019/05/msg00042.htmlMailing ListX Refsource MLIST
lists.opensuse.org/opensuse-security-announce/2019-08/msg00049.htmlVendor AdvisoryX Refsource SUSE
usn.ubuntu.com/3934-2/Vendor AdvisoryX Refsource UBUNTU
access.redhat.com/errata/RHSA-2019:2699Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2019:2978Vendor AdvisoryX Refsource REDHATAdvisory
security.alpinelinux.org/vuln/CVE-2019-6133Advisory
www.suse.com/support/update/announcement/2019/suse-su-20192018-1/Advisory
bugzilla.suse.com/1121826REPORT
www.suse.com/security/cve/CVE-2019-6133WEB
www.suse.com/support/update/announcement/2019/suse-su-20192035-1/Advisory
www.suse.com/support/update/announcement/2019/suse-su-20192035-2/Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1664212REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0230.jsonAdvisory
access.redhat.com/security/cve/CVE-2019-6133REPORT
www.cve.org/CVERecord?id=CVE-2019-6133AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2019-6133Advisory
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0420.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0832.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2699.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2978.jsonAdvisory
ubuntu.com/security/CVE-2019-6133REPORT
ubuntu.com/security/notices/USN-3901-1Advisory
ubuntu.com/security/notices/USN-3901-2Advisory
ubuntu.com/security/notices/USN-3903-1Advisory
ubuntu.com/security/notices/USN-3903-2Advisory
ubuntu.com/security/notices/USN-3908-1Advisory
ubuntu.com/security/notices/USN-3908-2Advisory
ubuntu.com/security/notices/USN-3910-1Advisory
ubuntu.com/security/notices/USN-3910-2Advisory
ubuntu.com/security/notices/USN-3934-1Advisory
ubuntu.com/security/notices/USN-3934-2Advisory
security-tracker.debian.org/tracker/CVE-2019-6133Advisory
lists.opensuse.org/archives/…Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities