REDHAT-BUG-2379675: Medium severity freedesktop.org polkit vulnerability

Published Jul 11, 2025

Updated

When polkit is processing a XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This can lead polkit to crash or other unexpected behavior and arbitrary code execution is not discarded. To explore this flaw, a high privilege account is needed as it's required to properly place the malicious policy file.

Affected Software

1 affected component

freedesktop.org polkit

Event History

Jul 11, 2025

Data Sourced

via Red Hat·10:00 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2379675?

The severity of REDHAT-BUG-2379675 is high due to the potential for crashes and unexpected behavior in polkit.

How do I fix REDHAT-BUG-2379675?

To fix REDHAT-BUG-2379675, you should apply the latest patch provided by Red Hat for polkit.

What happens if I exploit REDHAT-BUG-2379675?

Exploiting REDHAT-BUG-2379675 can lead to crashes of polkit and other unexpected behaviors, potentially allowing for arbitrary code execution.

Who is affected by REDHAT-BUG-2379675?

High privilege account users running polkit with XML policies containing 32 or more nested elements are affected by REDHAT-BUG-2379675.

What software versions are impacted by REDHAT-BUG-2379675?

The vulnerability REDHAT-BUG-2379675 affects the polkit software provided by freedesktop.org.