CyberRota Analysis
AI-GeneratedThe vulnerability affects the sh module in Python, specifically prior to version 2.2.4, allowing an elevated process to improperly drop privileges when launching commands with the _uid option. This incomplete privilege drop can enable the child process to retain access to sensitive resources associated with the parent process's supplementary groups, potentially leading to unauthorized access to files and resources. Organizations using affected versions on Linux or Docker should prioritize patching to mitigate the risk of privilege escalation and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.