Bug 1595404 – CVE-2018-1116 polkit: Improper authorization in polkit_backend_interactive_authority_check_authorization function in polkitd

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1595404 - (CVE-2018-1116) CVE-2018-1116 polkit: Improper authorization in polkit_backend_interactive_authority_check_authorization function in polkitd

Summary:	CVE-2018-1116 polkit: Improper authorization in polkit_backend_interactive_au...

Status:	NEW

Aliases:	CVE-2018-1116

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20180710,reported=2...
Keywords:	Security

Depends On:	1601411 1599790 1599791
Blocks:	1595405
	Show dependency tree / graph

Reported:	2018-06-26 16:45 EDT by Laura Pardo
Modified:	2018-07-24 13:42 EDT (History)
CC List:	3 users (show)

See Also:
Fixed In Version:	polkit 0.116
Doc Type:	If docs needed, set a value
Doc Text:	It was found that Polkit's CheckAuthorization and RegisterAuthenticationAgent D-Bus calls did not validate the client provided UID. A specially crafted program could use this flaw to submit arbitrary UIDs, triggering various denial of service or minor disclosures, such as which authentication is cached in the victim's session.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Laura Pardo 2018-06-26 16:45:29 EDT

A flaw was found in polkit. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.

Comment 1 Cedric Buissart 2018-07-10 11:21:00 EDT

Upstream fix:
https://cgit.freedesktop.org/polkit/commit/?id=bc7ffad5364

Comment 2 Cedric Buissart 2018-07-10 11:21:22 EDT

Created polkit tracking bugs for this issue:

Affects: fedora-all [bug 1599790]

Note You need to log in before you can comment on or make changes to this bug.