CVE-2016-2568: High severity Freedesktop polkit vulnerability
It was reported that when executing a program via "pkexec --user nonpriv program", the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing privilege escalation.
Original bug report (contains reproducer):
https://bugzilla.redhat.com/showbug.cgi?id=1299955
Other sources
pkexec, when used with --user nonpriv, allows local users to escape to the parent session
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/policykit-1to a version that resolves this vulnerability.Fixed in 126-2Fixed in 127-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 123-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.119-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.116-7
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2568?
CVE-2016-2568 is considered a high severity vulnerability due to its potential to allow privilege escalation.
How do I fix CVE-2016-2568?
To fix CVE-2016-2568, update the affected packages in your operating system to the latest versions that have addressed this vulnerability.
Which systems are affected by CVE-2016-2568?
CVE-2016-2568 affects systems utilizing policykit-1 and applications that make use of the TIOCSTI ioctl.
What could happen if CVE-2016-2568 is exploited?
If exploited, CVE-2016-2568 allows an unprivileged user to escalate their privileges to execute commands with higher permissions.
When was CVE-2016-2568 reported?
CVE-2016-2568 was reported in February 2016, raising concerns about the security of systems using affected software.