An update for polkit is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones.

Security Fix(es) :

* polkit: Temporary auth hijacking via PID reuse and non-atomic fork (CVE-2019-6133)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for polkit is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones.

Security Fix(es) :

* polkit: Temporary auth hijacking via PID reuse and non-atomic fork (CVE-2019-6133)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-0420 advisory.

    - Fix of CVE-2019-6133, PID reuse via slow fork

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3934-1 advisory.

    It was discovered that PolicyKit incorrectly relied on the fork() system call in the Linux kernel being     atomic. A local attacker could possibly use this issue to gain access to services that have cached     authorizations.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3908-1 advisory.

    Jann Horn discovered a race condition in the fork() system call in the Linux kernel. A local attacker     could use this to gain access to services that cache authorizations.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0832 advisory.

    The polkit packages provide a component for controlling system-wide privileges. This component provides a     uniform and organized way for non-privileged processes to communicate with privileged ones.

    Security Fix(es):

    * polkit: Temporary auth hijacking via PID reuse and non-atomic fork (CVE-2019-6133)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in polkit. When     authentication is performed by a non-root user to     perform an administrative task, the authentication is     temporarily cached in such a way that a local attacker     could impersonate the authorized process, thus gaining     access to elevated privileges.(CVE-2019-6133)

  - A race condition in perf_event_open() allows local     attackers to leak sensitive data from setuid programs.
    As no relevant locks (in particular the     cred_guard_mutex) are held during the     ptrace_may_access() call, it is possible for the     specified target task to perform an execve() syscall     with setuid execution before perf_event_alloc()     actually attaches to it, allowing an attacker to bypass     the ptrace_may_access() check and the     perf_event_exit_task(current) call that is performed in     install_exec_creds() during privileged execve()     calls.(CVE-2019-3901)

  - A race condition was found between between     mmget_not_zero()/get_task_mm() when core dumping tasks.
    A local attacker is able to exploit race condition     where locking of semaphore would allow an attacker to     leak kernel memory to userspace.(CVE-2019-3892)

  - A flaw was found in the Linux kernel where the coredump     implementation does not use locking or other mechanisms     to prevent vma layout or vma flags changes while it     runs. This allows local users to obtain sensitive     information, cause a denial of service (DoS), or     possibly have unspecified other impact by triggering a     race condition with mmget_not_zero or get_task_mm     calls.(CVE-2019-11599)

  - An issue was discovered in the Linux kernel before     4.20. There is a race condition in smp_task_timedout()     and smp_task_done() in     drivers/scsi/libsas/sas_expander.c, leading to a     use-after-free.(CVE-2018-20836)

  - A flaw was found in the Linux kernel, prior to version     5.0.7, in drivers/scsi/megaraid/megaraid_sas_base.c,     where a NULL pointer dereference can occur when     megasas_create_frame_pool() fails in     megasas_alloc_cmds(). An attacker can crash the system     if they were able to load the megaraid_sas kernel     module and groom memory beforehand, leading to a denial     of service (DoS), related to a     use-after-free.(CVE-2019-11810)

  - A flaw was found in the Linux kernel's implementation     of RDS over TCP. A system that has the rds_tcp kernel     module loaded (either through autoload via local     process running listen(), or manual loading) could     possibly cause a use after free (UAF) in which an     attacker who is able to manipulate socket state while a     network namespace is being torn down. This can lead to     possible memory corruption and privilege     escalation.(CVE-2019-11815)

  - Modern Intel microprocessors implement hardware-level     micro-optimizations to improve the performance of     writing data back to CPU caches. The write operation is     split into STA (STore Address) and STD (STore Data)     sub-operations. These sub-operations allow the     processor to hand-off address generation logic into     these sub-operations for optimized writes. Both of     these sub-operations write to a shared distributed     processor structure called the 'processor store     buffer'. As a result, an unprivileged attacker could     use this flaw to read private data resident within the     CPU's processor store buffer.(CVE-2018-12126)

  - A flaw was found in the implementation of the 'fill     buffer', a mechanism used by modern CPUs when a     cache-miss is made on L1 CPU cache. If an attacker can     generate a load operation that would create a page     fault, the execution will continue speculatively with     incorrect data from the fill buffer while the data is     fetched from higher level caches. This response time     can be measured to infer data in the fill     buffer.(CVE-2018-12130)

  - Microprocessors use a aEUR~load portaEURtm subcomponent to     perform load operations from memory or IO. During a     load operation, the load port receives data from the     memory or IO subsystem and then provides the data to     the CPU registers and operations in the CPUaEURtms     pipelines. Stale load operations results are stored in     the 'load port' table until overwritten by newer     operations. Certain load-port operations triggered by     an attacker can be used to reveal data about previous     stale requests leaking data back to the attacker via a     timing side-channel.(CVE-2018-12127)

  - Uncacheable memory on some microprocessors utilizing     speculative execution may allow an authenticated user     to potentially enable information disclosure via a side     channel with local access.(CVE-2019-11091)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0004 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-6133:
    In PolicyKit (aka polkit) 0.115, the start time protection mechanism can be bypassed because fork() is     not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid     checking in polkitbackend/polkitbackendinteractiveauthority.c.

    CVE-2021-4034:
    A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is     a setuid tool designed to allow unprivileged users to run commands as privileged users according     predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly     and ends trying to execute environment variables as commands. An attacker can leverage this by crafting     environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully     executed the attack can cause a local privilege escalation given unprivileged users administrative rights     on the target machine.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0004 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-6133:
    In PolicyKit (aka polkit) 0.115, the start time protection mechanism can be bypassed because fork() is     not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid     checking in polkitbackend/polkitbackendinteractiveauthority.c.

    CVE-2021-4034:
    A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is     a setuid tool designed to allow unprivileged users to run commands as privileged users according     predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly     and ends trying to execute environment variables as commands. An attacker can leverage this by crafting     environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully     executed the attack can cause a local privilege escalation given unprivileged users administrative rights     on the target machine.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
144538	Virtuozzo 6 : polkit / polkit-desktop-policy / polkit-devel / etc (VZLSA-2019-0420)	Nessus	Virtuozzo Local Security Checks	12/22/2020	2/20/2025	medium
122452	CentOS 6 : polkit (CESA-2019:0420)	Nessus	CentOS Local Security Checks	2/27/2019	3/20/2025	medium
122462	Oracle Linux 6 : polkit (ELSA-2019-0420)	Nessus	Oracle Linux Local Security Checks	2/27/2019	3/20/2025	medium
123750	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : PolicyKit vulnerability (USN-3934-1)	Nessus	Ubuntu Local Security Checks	4/4/2019	3/12/2025	medium
122813	Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-3908-1)	Nessus	Ubuntu Local Security Checks	3/13/2019	3/20/2025	medium
124258	RHEL 6 : polkit (RHSA-2019:0832)	Nessus	Red Hat Local Security Checks	4/24/2019	3/11/2025	medium
125564	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1612)	Nessus	Huawei Local Security Checks	5/30/2019	5/17/2024	high
236558	Alibaba Cloud Linux 3 : 0004: polkit (ALINUX3-SA-2022:0004)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	high
240032	TencentOS Server 3: polkit (TSSA-2022:0004)	Nessus	Tencent Local Security Checks	6/16/2025	11/23/2025	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

high

high

high