Local Privilege Escalation in Python 3.9.x and 3.10.x on Linux
Summary
CVE-2022-42919: Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. Affects python3 across 2 version ranges.
< 3.10.9-r0
>= 9cf6752276e6fcfd0c23fdb064ad27f448aaaf75, < 595f9ccb0c059f2fb5bf13643bfc0cdd5b55a422
Fixed in 3.10.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a popular programming language known for its simplicity and versatility. It is widely used for various applications, including web development, data analysis, and automation. Python 3.9.x and 3.10.x are two major versions of Python. These versions introduce new features and improvements to the language. However, a vulnerability has been discovered in these versions when running on Linux systems.
Vulnerability Detail
The vulnerability, identified as CVE-2022-42919, allows for local privilege escalation in a non-default configuration. It specifically affects the Python multiprocessing library when used with the forkserver start method on Linux. The issue arises due to the deserialization of pickles from any user in the same machine local network namespace. This means that any user on the same machine can execute arbitrary code through pickles, leading to local user privilege escalation. The vulnerability is specific to Linux systems that support abstract namespace sockets, which are used by the multiprocessing library. Prior versions of CPython (Python's reference implementation) did not make use of abstract namespace sockets by default. However, support for manually specifying an abstract namespace socket was added in versions 3.7.8 and 3.8.3 as a bugfix. The default start method for multiprocessing is not affected by this vulnerability.
How To Fix
Minimum fixed version
3.10.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Python immediately is not feasible, a workaround is available. By setting the 'multiprocessing.util.abstract_sockets_supported' variable to False, the vulnerability can be mitigated. This can be done by adding the following line of code before using the multiprocessing library:
import multiprocessing.util multiprocessing.util.abstract_sockets_supported = False
Conclusion
In conclusion, Python versions 3.9.x and 3.10.x on Linux are vulnerable to local privilege escalation. This can be mitigated by updating Python to version 3.10.9 or later. Alternatively, setting 'multiprocessing.util.abstract_sockets_supported' to False can serve as a temporary workaround. It is important to address this vulnerability promptly to prevent potential unauthorized access and system compromise. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3 →
FAQ
The vulnerability allows for local privilege escalation, enabling an attacker to gain elevated privileges on the affected system. This can lead to unauthorized access, data theft, and potential compromise of the entire system.
Yes, the vulnerability is specific to Linux systems that support abstract namespace sockets. Other operating systems are not affected.
Python 3.9.x and 3.10.x versions on Linux are affected. Prior versions of Python and non-Linux systems are not impacted.
The default start method for multiprocessing is not affected by this vulnerability. Only the forkserver start method on Linux is vulnerable.
At the time of this report, there are no known public exploits targeting this vulnerability. However, it is crucial to apply the recommended fixes to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for python3.
