A Local Privilege Escalation vulnerability (from any user to root) was found in polkit's pkexec, a SUID-root program that is installed by default on every major Linux distribution.
polkit has a vulnerability that allows a local attacker to hijack a PID during an authentication attempt by a non-root user and subsequently execute code as the authenticated process.
Upstream patch:
https://gitlab.freedesktop.org/polkit/polkit/commit/c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81 https://gitlab.freedesktop.org/polkit/polkit/mergerequests/19 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7b55851367136b1efd84d98fea81ba57a98304cf
It was found that creating a user of group above INT32MAX would wrap around the numeric uid or gid. Polkit is not able to handle this properly, resulting in an authentication bypass.
References:
https://seclists.org/oss-sec/2018/q4/198
Upstream issue:
https://gitlab.freedesktop.org/polkit/polkit/issues/74
Proposed patch:
https://gitlab.freedesktop.org/zbyszek/polkit/commit/fbaab32cb4ed9ed5f1e3eea6cd317d443aa427dc
It was reported that if polkit, while reading action descriptions from /usr/share/polkit-1/actions, encounters a duplicate action ID, it corrupts the heap. The effects of corruption are e.g. visible on stderr as frequent use of unrelated strings when running polkit without --no-debug.
Presumably a local attacker might be able to manipulate polkit’s heap enough to achieve privilege escalation through this.
Upstream bug: https://bugs.freedesktop.org/showbug.cgi?id=83590 Upstream patch is attached.
Sebastian Krahmer reported a security issue was found in polkit (CVE-2013-4288 bz 1002375).
It was found that systemd was vulnerable to this issue as well, since it communicated to polkit authority using an unsafe DBUS interface.
This issue has been assigned CVE-2013-4327
Sebastian Krahmer reported a security issue was found in polkit (CVE-2013-4288 bz 1002375).
It was found that rtkit was vulnerable to this issue as well, since it communicated to polkit authority using an unsafe DBUS interface.
This issue has been assigned CVE-2013-4326
Sebastian Krahmer reported a security issue was found in polkit (CVE-2013-4288 bz 1002375).
It was found that hplip was vulnerable to this issue as well, since it communicated to polkit authority using an unsafe DBUS interface.
This issue has been assigned CVE-2013-4325