Bug 1565992 (CVE-2018-1106)

Summary:	CVE-2018-1106 PackageKit: authentication bypass allows to install signed packages without administrator privileges
Product:	[Other] Security Response	Reporter:	Riccardo Schirone <rschiron>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jonathan, klember, rdieter, rhughes, security-response-team, smparrish, zacharyewarren
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	PackageKit 1.1.10	Doc Type:	If docs needed, set a value
Doc Text:	An authentication bypass flaw has been found in PackageKit that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-04-26 08:07:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1566425, 1566426, 1570872
Bug Blocks:	1565197

Description Riccardo Schirone 2018-04-11 09:36:40 UTC

An authentication bypass flaw has been found in PackageKit since version 1.0.2.
A local attacker can bypass the authentication in
pk_transaction_authorize_actions_finished_cb function of pk-transaction.c file,
and install signed packages without administrator privileges.

Patch:
https://github.com/hughsie/PackageKit/commit/7e8a7905ea9abbd1f384f05f36a4458682cd4697

Upstream vulnerable commit:
https://github.com/hughsie/PackageKit/commit/f176976e24e8c17b80eff222572275517c16bdad

Comment 1 Adam Mariš 2018-04-11 10:54:54 UTC

Acknowledgments:

Name: Matthias Gerstner (SUSE)

Comment 6 Riccardo Schirone 2018-04-23 15:25:08 UTC

External References:

http://www.openwall.com/lists/oss-security/2018/04/23/3

Comment 7 Zach Warren 2018-04-23 21:42:50 UTC

This appears to be very similar to a previously rejected vulnerability from 2014. How does this differ from the "grinch" vulnerability?

Sources:
[1] https://access.redhat.com/articles/1298913
[2] https://www.alertlogic.com/blog/dont-let-the-grinch-steal-christmas/

Comment 8 Riccardo Schirone 2018-04-24 07:19:38 UTC

Though, as said in your sources, PackageKit+PolKit allow a wheel member to install packages without inserting any password, we don't consider that a vulnerability, but it is one of the reasons of PackageKit existence. Instead the current CVE is about a complete authentication bypass, even for non-members of the wheel group.

Comment 9 errata-xmlrpc 2018-04-24 18:32:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:1224 https://access.redhat.com/errata/RHSA-2018:1224