REDHAT-BUG-1245684
First published: Wed Jul 22 2015(Updated: )
It was reported that polkit has a bug, that leads to a minor denial of service, or code execution/privilege escalation. The only privilege necessary is ability to send D-Bus messages, not even necessarily directly to polkitd (usually privileged services ask polkitd for authorization based of a client request: client<->D-Bus<->service<->D-Bus<->polkitd); the attacker does not need special polkit status. This bug allows a local user (a person on a multi-user system, or a daemon account after successfully attacking a daemon over the network) to corrupt memory of polkitd. Corrupting polkitd memory can lead to a crash (known to happen), which is a minor DoS: a specific request being handled during the crash will not get a reply, but polkitd will then be automatically started when next polkit request arrives. In general corrupting memory can lead to arbitrary code execution as polkitd (no proof of concept exists but I can see no reason for this to be impossible), controlling polkitd allows the attacker to grant to anyone access to any polkit-controlled service, including the ability to run any command as root via pkexec. Initially reported in <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - [abrt] polkit-0.107-4.fc18: js::PropertyTable::search: Process /usr/lib/polkit-1/polkitd was killed by signal 11 (SIGSEGV)" href="show_bug.cgi?id=910262">https://bugzilla.redhat.com/show_bug.cgi?id=910262</a> The patches are attached.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Polkit |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=910262
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054871
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054871&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054872
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054872&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054873
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054873&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054874
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054874&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054875
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054875&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054876
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054876&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054877
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054877&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054878
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054878&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054879
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054879&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054880
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1054880&action=edit
- https://rhn.redhat.com/errata/RHSA-2016-0189.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1245684
Frequently Asked Questions
What is the severity of REDHAT-BUG-1245684?
REDHAT-BUG-1245684 has a minor severity level associated with potential denial of service and privilege escalation issues.
How does REDHAT-BUG-1245684 affect polkit?
REDHAT-BUG-1245684 causes polkit to potentially allow denial of service or unauthorized code execution due to improper handling of D-Bus messages.
Who is affected by REDHAT-BUG-1245684?
Any user or system component that can send D-Bus messages to polkit may be affected by REDHAT-BUG-1245684.
How can I resolve the issue described in REDHAT-BUG-1245684?
To resolve the issue in REDHAT-BUG-1245684, it is advisable to update to the latest version of polkit that addresses this vulnerability.
Is there a workaround for REDHAT-BUG-1245684?
There are no specific workarounds mentioned for REDHAT-BUG-1245684, so upgrading to the patched version is recommended.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-3256
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/polkit
- canonical/polkit