CVE-2015-3256
First published: Wed Jul 22 2015(Updated: )
It was reported that polkit has a bug, that leads to a minor denial of service, or code execution/privilege escalation. The only privilege necessary is ability to send D-Bus messages, not even necessarily directly to polkitd (usually privileged services ask polkitd for authorization based of a client request: client<->D-Bus<->service<->D-Bus<->polkitd); the attacker does not need special polkit status. This bug allows a local user (a person on a multi-user system, or a daemon account after successfully attacking a daemon over the network) to corrupt memory of polkitd. Corrupting polkitd memory can lead to a crash (known to happen), which is a minor DoS: a specific request being handled during the crash will not get a reply, but polkitd will then be automatically started when next polkit request arrives. In general corrupting memory can lead to arbitrary code execution as polkitd (no proof of concept exists but I can see no reason for this to be impossible), controlling polkitd allows the attacker to grant to anyone access to any polkit-controlled service, including the ability to run any command as root via pkexec. Initially reported in <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - [abrt] polkit-0.107-4.fc18: js::PropertyTable::search: Process /usr/lib/polkit-1/polkitd was killed by signal 11 (SIGSEGV)" href="show_bug.cgi?id=910262">https://bugzilla.redhat.com/show_bug.cgi?id=910262</a> The patches are attached.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| polkit | <=0.112 | |
| openSUSE | =13.1 | |
| openSUSE | =13.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=910262
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054871
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054871&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054872
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054872&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054873
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054873&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054874
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054874&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054875
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054875&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054876
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054876&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054877
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054877&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054878
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054878&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054879
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054879&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054880
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054880&action=edit
- https://rhn.redhat.com/errata/RHSA-2016-0189.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1245684
- http://lists.freedesktop.org/archives/polkit-devel/2015-July/000432.html
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00010.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00042.html
- http://rhn.redhat.com/errata/RHSA-2016-0189.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/77356
- http://www.securitytracker.com/id/1035023
Frequently Asked Questions
What is the severity of CVE-2015-3256?
The severity of CVE-2015-3256 is considered to be minor as it leads to a denial of service or potential privilege escalation.
How do I fix CVE-2015-3256?
To fix CVE-2015-3256, upgrade to polkit version greater than 0.112.
What systems are affected by CVE-2015-3256?
CVE-2015-3256 affects polkit versions up to 0.112 and specific versions of openSUSE 13.1 and 13.2.
What is the impact of exploiting CVE-2015-3256?
Exploiting CVE-2015-3256 may lead to a denial of service or allow an attacker to execute code with elevated privileges.
Is CVE-2015-3256 related to D-Bus messaging?
Yes, CVE-2015-3256 involves sending D-Bus messages which could be leveraged for privilege escalation.
- agent/type
- agent/first-publish-date
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-3256
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/polkit project
- canonical/polkit
- version/polkit/0.112
- vendor/opensuse
- canonical/opensuse
- version/opensuse/13.1
- version/opensuse/13.2