Privilege Escalation Vulnerability in Python 3.12 Subprocess Module
Summary
UBUNTU-CVE-2023-6507: An issue was found in CPython 3.12.0 subprocess module on POSIX platforms. Affects python3.12 versions < 3.12.1-2. Fixed in 3.12.1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is a widely used programming language known for its readability and versatility. The subprocess module allows users to spawn new processes, connect to their input/output/error pipes, and obtain their return codes. This functionality is crucial for executing system commands and managing subprocesses. However, a vulnerability was identified in the subprocess module that affects processes running with elevated privileges, specifically when using the 'extra_groups' parameter with an empty list.
Vulnerability Detail
An issue was found in CPython 3.12.0 subprocess module on POSIX platforms. The vulnerability arises when the 'extra_groups' parameter is set to an empty list (i.e., extra_groups=[]). In this case, the logic fails to call 'setgroups(0, NULL)' before executing a new process, which means the original process's group privileges are not dropped. This oversight can lead to privilege escalation, allowing unauthorized access to resources by processes that should have limited permissions. The issue was fixed in CPython 3.12.1 and does not affect other stable releases.
How To Fix
Minimum fixed version
3.12.1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'extra_groups' parameter with an empty list when calling subprocess functions. Instead, provide a valid list of group IDs or omit the parameter altogether.
Conclusion
In summary, a privilege escalation vulnerability has been identified in the subprocess module of Python 3.12.0, which can be exploited by processes with sufficient privileges. Users are advised to update to version 3.12.1 or later to mitigate this risk. Additionally, temporary workarounds are available to reduce exposure until an update can be applied.
See every vulnerability recorded for python3.12 →
FAQ
The CVSS score of this vulnerability is 4.9, indicating a medium severity level.
The vulnerability affects Python 3.12.0 and earlier versions. It has been fixed in Python 3.12.1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If exploited, this vulnerability can lead to privilege escalation, allowing unauthorized processes to access sensitive resources.
Yes, you can mitigate the risk by avoiding the use of the 'extra_groups' parameter with an empty list in your subprocess calls.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
