Bug 1228738 (CVE-2015-3218) - CVE-2015-3218 polkit: crash authentication_agent_new with invalid object path in RegisterAuthenticationAgent
Summary: CVE-2015-3218 polkit: crash authentication_agent_new with invalid object path...
Status: NEW
Alias: CVE-2015-3218
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20150529,reported=2...
Keywords: Reopened, Security
Depends On: 1228739
Blocks: 1228745
TreeView+ depends on / blocked
 
Reported: 2015-06-05 14:50 UTC by Vasyl Kaigorodov
Modified: 2019-06-08 20:37 UTC (History)
3 users (show)

(edit)
A NULL-pointer dereference flaw was discovered in polkitd. A malicious, local user could exploit this flaw to crash polkitd.
Clone Of:
(edit)
Last Closed: 2015-06-19 17:11:03 UTC


Attachments (Terms of Use)

Description Vasyl Kaigorodov 2015-06-05 14:50:11 UTC
It was reported that polkitd dumps core if you set an invalid object
path when calling RegisterAuthenticationAgent.
It allows local authenticated users to perform a denial of service attack.
Original report: http://lists.freedesktop.org/archives/polkit-devel/2015-May/000420.html
SUggested patch is available: http://lists.freedesktop.org/archives/polkit-devel/2015-May/000421.html

Comment 1 Vasyl Kaigorodov 2015-06-05 14:50:47 UTC
Created polkit tracking bugs for this issue:

Affects: fedora-all [bug 1228739]

Comment 3 Stefan Cornelius 2015-06-19 17:11:03 UTC
It looks like this was introduced via http://cgit.freedesktop.org/polkit/commit/?id=6eeb077bc90c9c7783360a526b2f04645b1b0848

In authentication_agent_new():
>  error = NULL;
>  agent->proxy = g_dbus_proxy_new_for_bus_sync (
>                                       <snip>various params</snip>
>                                                &error);
>  if (agent->proxy == NULL)
>    {
>      g_warning ("Error constructing proxy for agent: %s", error->message);

error can still be NULL after the call to g_dbus_proxy_new_for_bus_sync(). In that case we crash when trying to dereference error->message.

The version in RHEL6 does not have this commit and is not affected. RHEL7 is affected.

Comment 5 Fedora Update System 2015-07-13 19:08:52 UTC
polkit-0.113-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2015-07-21 08:23:36 UTC
polkit-0.113-4.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.