CVE-2022-21699
📋 TL;DR
CVE-2022-21699 is an arbitrary code execution vulnerability in IPython where improper management of cross-user temporary files allows one user to execute code as another user on the same system. This affects all IPython users on multi-user systems where IPython is installed. The vulnerability stems from insecure temporary file handling that enables privilege escalation.
💻 Affected Systems
- IPython
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Ipython by Ipython
Ipython by Ipython
Ipython by Ipython
Ipython by Ipython
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise where an attacker gains root privileges through privilege escalation chains, potentially leading to complete system takeover, data exfiltration, or lateral movement across the network.
Likely Case
Local privilege escalation allowing a low-privileged user to execute code as another user, potentially accessing sensitive data or performing unauthorized actions under another user's context.
If Mitigated
Limited impact with proper user isolation, where only users with shell access to the same system could potentially exploit each other, but network-based attacks would be prevented.
🎯 Exploit Status
Exploitation requires local shell access to the target system. The vulnerability is well-documented in the advisory with technical details that make weaponization straightforward for attackers with shell access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.0.1 and later
Vendor Advisory: https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x
Restart Required: No
Instructions:
1. Upgrade IPython using pip: 'pip install --upgrade ipython>=8.0.1' 2. Verify installation: 'ipython --version' should show 8.0.1 or higher 3. For system packages, use your distribution's package manager: 'apt update && apt upgrade ipython' (Debian/Ubuntu) or 'yum update ipython' (RHEL/CentOS)
🔧 Temporary Workarounds
Temporary directory hardening
linuxSet secure permissions on IPython temporary directories to prevent cross-user access
chmod 700 ~/.ipython
chmod 700 /tmp/ipython-* 2>/dev/null || true
Use isolated environments
allRun IPython in containerized or virtualized environments with proper user isolation
docker run -it --rm python:3.9 ipython
python -m venv myenv && source myenv/bin/activate && pip install ipython
🧯 If You Can't Patch
- Implement strict user isolation policies on multi-user systems to limit shell access
- Monitor for suspicious file operations in /tmp and user home directories, particularly symlink attacks targeting IPython temporary files
🔍 How to Verify
Check if Vulnerable:
Check IPython version: 'ipython --version' and compare to 8.0.1. Versions below 8.0.1 are vulnerable.Check Version:
ipython --versionVerify Fix Applied:
After upgrade, verify version is 8.0.1 or higher: 'ipython --version' and test that temporary files created by IPython have secure permissions.📡 Detection & Monitoring
Log Indicators:
- Unusual file operations in /tmp directory by IPython processes
- Symlink creation attempts in user home directories
- Multiple IPython processes running under different user IDs accessing same temporary files
Network Indicators:
- Not applicable - this is a local vulnerability
SIEM Query:
process_name:"ipython" AND file_path:"/tmp/ipython-*" AND (file_operation:"symlink" OR file_operation:"hardlink")🔗 References
- https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668
- https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x
- https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699
- https://lists.debian.org/debian-lts-announce/2022/01/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRQRTWHYXMLDJ572VGVUZMUPEOTPM3KB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZ7LVZBB4D7KVSFNEQUBEHFO3JW6D2ZK/
- https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668
- https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x
- https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699
- https://lists.debian.org/debian-lts-announce/2022/01/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRQRTWHYXMLDJ572VGVUZMUPEOTPM3KB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZ7LVZBB4D7KVSFNEQUBEHFO3JW6D2ZK/
