Medium
Security advisory
In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-6133
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 09:45 UTC · Revision 1
Source evidence
In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.
osv:CVE-2019-6133
Complete source record
{
"id": "acae82c1c8ceda95c8a8cbc56c3a6da6036484f5366d08ad5a73daba71759718",
"url": "https://osv.dev/vulnerability/CVE-2019-6133",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-6133",
"summary": "In PolicyKit (aka polkit) 0.115, the \"start time\" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.",
"evidence": "osv:CVE-2019-6133",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-6133",
"aliases": [
"CVE-2019-6133"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://gitlab.freedesktop.org/polkit/polkit",
"type": "GIT",
"events": [
{
"introduced": "b0a5d0f1a5b835819da630a6d27ed89dd4d7f464"
},
{
"last_affected": "b0a5d0f1a5b835819da630a6d27ed89dd4d7f464"
},
{
"fixed": "c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:polkit_project:polkit:0.115:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.115"
},
{
"last_affected": "0.115"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"0.115"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-6133.json"
}
}
],
"modified": "2026-10-20T10:47:52.398554037Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html",
"https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html",
"https://usn.ubuntu.com/3934-2/",
"https://access.redhat.com/errata/RHSA-2019:0230",
"https://access.redhat.com/errata/RHSA-2019:0420",
"https://access.redhat.com/errata/RHSA-2019:0832",
"https://access.redhat.com/errata/RHSA-2019:2699",
"https://access.redhat.com/errata/RHSA-2019:2978",
"https://lists.debian.org/debian-lts-announce/2019/01/msg00021.html",
"https://support.f5.com/csp/article/K22715344",
"https://usn.ubuntu.com/3901-1/",
"https://usn.ubuntu.com/3901-2/",
"https://usn.ubuntu.com/3903-1/",
"https://usn.ubuntu.com/3903-2/",
"https://usn.ubuntu.com/3908-1/",
"https://usn.ubuntu.com/3908-2/",
"https://usn.ubuntu.com/3910-1/",
"https://usn.ubuntu.com/3910-2/",
"https://usn.ubuntu.com/3934-1/",
"https://bugs.chromium.org/p/project-zero/issues/detail?id=1692",
"https://git.kernel.org/linus/7b55851367136b1efd84d98fea81ba57a98304cf",
"https://gitlab.freedesktop.org/polkit/polkit/commit/c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81",
"https://gitlab.freedesktop.org/polkit/polkit/merge_requests/19"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "12.04"
},
{
"last_affected": "12.04"
},
{
"introduced": "14.04"
},
{
"last_affected": "14.04"
},
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
},
{
"introduced": "18.10"
},
{
"last_affected": "18.10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_desktop",
"extracted_events": [
{
"range": [
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
},
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server",
"extracted_events": [
{
"range": [
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
},
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server_aus",
"extracted_events": [
{
"range": [
{
"introduced": "7.6"
},
{
"last_affected": "7.6"
},
{
"introduced": "6.6"
},
{
"last_affected": "6.6"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server_eus",
"extracted_events": [
{
"range": [
{
"introduced": "7.6"
},
{
"last_affected": "7.6"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server_tus",
"extracted_events": [
{
"range": [
{
"introduced": "7.6"
},
{
"last_affected": "7.6"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_workstation",
"extracted_events": [
{
"range": [
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
},
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-6133",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 379797,
"published_at": "2019-01-11T14:29:00.39+00:00"
}