7-Year-Old Polkit Flaw Lets Unprivileged Linux Users Gain Root Access

[silversurfer]

Content source

https://thehackernews.com/2021/06/7-year-old-polkit-flaw-lets.html

A seven-year-old privilege escalation vulnerability discovered in the polkit system service could be exploited by a malicious unprivileged local attacker to bypass authorization and escalate permissions to the root user.

Tracked as CVE-2021-3560 (CVSS score: 7.8), the flaw affects polkit versions between 0.113 and 0.118 and was discovered by GitHub security researcher Kevin Backhouse, who said the issue was introduced in a code commit made on Nov. 9, 2013. Red Hat's Cedric Buissart noted that Debian-based distributions, based on polkit 0.105, are also vulnerable.

Polkit (née PolicyKit) is a toolkit for defining and handling authorizations in Linux distributions, and is used for allowing unprivileged processes to communicate with privileged processes.

"When a requesting process disconnects from dbus-daemon just before the call to polkit_system_bus_name_get_creds_sync starts, the process cannot get a unique uid and pid of the process and it cannot verify the privileges of the requesting process," Red Hat said in an advisory. "The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability."

7-Year-Old Polkit Flaw Lets Unprivileged Linux Users Gain Root Access

A newly uncovered 7-Year-Old Polkit vulnerability (CVE-2021-3560) could let unprivileged Linux users gain root-level access on targeted systems.

thehackernews.com

 

[The_King]

History of CVE-2021-3560 and vulnerable distributions​

The bug I found was quite old. It was introduced seven years ago in commit bfa5036 and first shipped with polkit version 0.113. However, many of the most popular Linux distributions didn’t ship the vulnerable version until more recently.

The bug has a slightly different history on Debian and its derivatives (such as Ubuntu), because Debian uses a fork of polkit with a different version numbering scheme. In the Debian fork, the bug was introduced in commit f81d021 and first shipped with version 0.105-26. The most recent stable release of Debian, Debian 10 (“buster”), uses version 0.105-25, which means that it isn’t vulnerable. However, some Debian derivatives, such as Ubuntu, are based on Debian unstable, which is vulnerable.

Here’s a table with a selection of popular distributions and whether they’re vulnerable (note that this isn’t a comprehensive list):

Privilege escalation with polkit: How to get root on Linux with a seven-year-old bug

polkit is a system service installed by default on many Linux distributions. It’s used by systemd, so any Linux distribution that uses systemd also uses polkit.

github.blog