Bug 1595404 (CVE-2018-1116) - CVE-2018-1116 polkit: Improper authorization in polkit_backend_interactive_authority_check_authorization function in polkitd
Summary: CVE-2018-1116 polkit: Improper authorization in polkit_backend_interactive_au...
Keywords:
Status: NEW
Alias: CVE-2018-1116
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20180710,reported=2...
Depends On: 1601411 1599790 1599791
Blocks: 1595405
TreeView+ depends on / blocked
 
Reported: 2018-06-26 20:45 UTC by Laura Pardo
Modified: 2019-06-08 22:58 UTC (History)
3 users (show)

Fixed In Version: polkit 0.116
Doc Type: If docs needed, set a value
Doc Text:
It was found that Polkit's CheckAuthorization and RegisterAuthenticationAgent D-Bus calls did not validate the client provided UID. A specially crafted program could use this flaw to submit arbitrary UIDs, triggering various denial of service or minor disclosures, such as which authentication is cached in the victim's session.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Laura Pardo 2018-06-26 20:45:29 UTC
A flaw was found in polkit. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.

Comment 1 Cedric Buissart 🐶 2018-07-10 15:21:00 UTC
Upstream fix:
https://cgit.freedesktop.org/polkit/commit/?id=bc7ffad5364

Comment 2 Cedric Buissart 🐶 2018-07-10 15:21:22 UTC
Created polkit tracking bugs for this issue:

Affects: fedora-all [bug 1599790]


Note You need to log in before you can comment on or make changes to this bug.