Python CPython up to 3.12.0/3.13.0a2 on Posix Subprocess exec extra_groups privileges management

Summaryinfo

A vulnerability was found in Python CPython up to 3.12.0/3.13.0a2 on Posix. It has been classified as critical. The impacted element is the function exec of the component Subprocess Module. Performing a manipulation of the argument extra_groups results in privileges management. This vulnerability is reported as CVE-2023-6507. The attacker must have access to the local network to execute the attack. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in Python CPython up to 3.12.0/3.13.0a2 on Posix (Programming Language Software). This affects the function exec of the component Subprocess Module. The manipulation of the argument extra_groups with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).

The weakness was disclosed 12/08/2023. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2023-6507 since 12/04/2023. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 3.12.1 or 3.13.0a3 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Python

Name

• CPython

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12.0
• 3.13.0a2

License

• open-source

Website

• Product: https://github.com/python/cpython/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion