CVE-2015-3256
First published: Wed Jul 22 2015(Updated: )
It was reported that polkit has a bug, that leads to a minor denial of service, or code execution/privilege escalation. The only privilege necessary is ability to send D-Bus messages, not even necessarily directly to polkitd (usually privileged services ask polkitd for authorization based of a client request: client<->D-Bus<->service<->D-Bus<->polkitd); the attacker does not need special polkit status. This bug allows a local user (a person on a multi-user system, or a daemon account after successfully attacking a daemon over the network) to corrupt memory of polkitd. Corrupting polkitd memory can lead to a crash (known to happen), which is a minor DoS: a specific request being handled during the crash will not get a reply, but polkitd will then be automatically started when next polkit request arrives. In general corrupting memory can lead to arbitrary code execution as polkitd (no proof of concept exists but I can see no reason for this to be impossible), controlling polkitd allows the attacker to grant to anyone access to any polkit-controlled service, including the ability to run any command as root via pkexec. Initially reported in <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - [abrt] polkit-0.107-4.fc18: js::PropertyTable::search: Process /usr/lib/polkit-1/polkitd was killed by signal 11 (SIGSEGV)" href="show_bug.cgi?id=910262">https://bugzilla.redhat.com/show_bug.cgi?id=910262</a> The patches are attached.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Polkit Project Polkit | <=0.112 | |
| openSUSE openSUSE | =13.1 | |
| openSUSE openSUSE | =13.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=910262
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054871
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054871&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054872
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054872&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054873
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054873&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054874
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054874&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054875
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054875&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054876
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054876&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054877
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054877&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054878
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054878&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054879
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054879&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054880
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054880&action=edit
- https://rhn.redhat.com/errata/RHSA-2016-0189.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1245684
- http://lists.freedesktop.org/archives/polkit-devel/2015-July/000432.html
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00010.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00042.html
- http://rhn.redhat.com/errata/RHSA-2016-0189.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/77356
- http://www.securitytracker.com/id/1035023
- agent/type
- agent/first-publish-date
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-3256
- vendor/polkit project
- canonical/polkit project polkit
- version/polkit project polkit/0.112
- vendor/opensuse
- canonical/opensuse opensuse
- version/opensuse opensuse/13.1
- version/opensuse opensuse/13.2