Bug 1228738 (CVE-2015-3218)

Summary:	CVE-2015-3218 polkit: crash authentication_agent_new with invalid object path in RegisterAuthenticationAgent
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	carnil, mitr, slawomir
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	A NULL-pointer dereference flaw was discovered in polkitd. A malicious, local user could exploit this flaw to crash polkitd.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-06-11 21:04:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1228739
Bug Blocks:	1228745

Description Vasyl Kaigorodov 2015-06-05 14:50:11 UTC

It was reported that polkitd dumps core if you set an invalid object
path when calling RegisterAuthenticationAgent.
It allows local authenticated users to perform a denial of service attack.
Original report: http://lists.freedesktop.org/archives/polkit-devel/2015-May/000420.html
SUggested patch is available: http://lists.freedesktop.org/archives/polkit-devel/2015-May/000421.html

Comment 1 Vasyl Kaigorodov 2015-06-05 14:50:47 UTC

Created polkit tracking bugs for this issue:

Affects: fedora-all [bug 1228739]

Comment 2 Stefan Cornelius 2015-06-19 15:09:49 UTC

Commit fixing this:
http://cgit.freedesktop.org/polkit/commit/src/polkitbackend/polkitbackendinteractiveauthority.c?id=48e646918efb2bf0b3b505747655726d7869f31c

Comment 3 Stefan Cornelius 2015-06-19 17:11:03 UTC

It looks like this was introduced via http://cgit.freedesktop.org/polkit/commit/?id=6eeb077bc90c9c7783360a526b2f04645b1b0848

In authentication_agent_new():
>  error = NULL;
>  agent->proxy = g_dbus_proxy_new_for_bus_sync (
>                                       <snip>various params</snip>
>                                                &error);
>  if (agent->proxy == NULL)
>    {
>      g_warning ("Error constructing proxy for agent: %s", error->message);

error can still be NULL after the call to g_dbus_proxy_new_for_bus_sync(). In that case we crash when trying to dereference error->message.

The version in RHEL6 does not have this commit and is not affected. RHEL7 is affected.

Comment 5 Fedora Update System 2015-07-13 19:08:52 UTC

polkit-0.113-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2015-07-21 08:23:36 UTC

polkit-0.113-4.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Product Security DevOps Team 2021-06-11 21:04:14 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2015-3218