CVSS: 7.8EPSS: 0%CPEs: 56EXPL: 33CVE-2021-4034 – Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
https://notcve.org/view.php?id=CVE-2021-4034
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. • https://github.com/dzonerzy/poc-cve-2021-4034 https://github.com/arthepsy/CVE-2021-4034 https://github.com/berdav/CVE-2021-4034 https://www.exploit-db.com/exploits/50689 https://github.com/PwnFunction/CVE-2021-4034 https://github.com/joeammond/CVE-2021-4034 https://github.com/nikaiw/CVE-2021-4034 https://github.com/ryaagard/CVE-2021-4034 https://github.com/Rvn0xsy/CVE-2021-4034 https://github.com/Ayrx/CVE-2021-4034 https://github.com/zhzyker/CVE-2021-4034& • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 1%CPEs: 9EXPL: 23CVE-2021-3560 – Red Hat Polkit Incorrect Authorization Vulnerability
https://notcve.org/view.php?id=CVE-2021-3560
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se ha detectado que polkit podía ser engañado para omitir las comprobaciones de credenciales para las peticiones de D-Bus, elevando los privilegios del solicitante al usuario root. Este fallo podría ser usado por un atacante local no privilegiado para, por ejemplo, crear un nuevo administrador local. • https://www.exploit-db.com/exploits/50011 https://github.com/secnigma/CVE-2021-3560-Polkit-Privilege-Esclation https://github.com/RicterZ/CVE-2021-3560-Authentication-Agent https://github.com/hakivvi/CVE-2021-3560 https://github.com/WinMin/CVE-2021-3560 https://github.com/0dayNinja/CVE-2021-3560 https://github.com/AssassinUKG/Polkit-CVE-2021-3560 https://github.com/chenaotian/CVE-2021-3560 https://github.com/BizarreLove/CVE-2021-3560 https://github.com/cpu0x00/CVE-2021-3560&# • CWE-754: Improper Check for Unusual or Exceptional Conditions CWE-863: Incorrect Authorization •
CVSS: 4.7EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1116 – polkit: Improper authorization in polkit_backend_interactive_authority_check_authorization function in polkitd
https://notcve.org/view.php?id=CVE-2018-1116
A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure. Se ha descubierto un problema en versiones anteriores a la 0.116 de polkit. La implementación de la función polkit_backend_interactive_authority_check_authorization en polkitd permite probar la autenticación y desencadenar la autenticación de procesos no relacionados propiedad de otros usuarios. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1116 https://cgit.freedesktop.org/polkit/commit/?id=bc7ffad5364 https://lists.debian.org/debian-lts-announce/2018/07/msg00042.html https://security.gentoo.org/glsa/201908-14 https://usn.ubuntu.com/3717-2 https://access.redhat.com/security/cve/CVE-2018-1116 https://bugzilla.redhat.com/show_bug.cgi?id=1595404 • CWE-285: Improper Authorization CWE-862: Missing Authorization •
CVSS: 4.6EPSS: 0%CPEs: 3EXPL: 0CVE-2015-3256 – polkit: Memory corruption via javascript rule evaluation
https://notcve.org/view.php?id=CVE-2015-3256
PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation." PolicyKit (también conocido como polkit) en versiones anteriores a 0.113 permite a usuarios locales provocar una denegación de servicio (corrupción de memoria y caída del demonio polkitd) y posiblemente obtener privilegios a través de vectores no especificados, relacionado con 'regla de evaluación javascript'. A denial of service flaw was found in how polkit handled authorization requests. A local, unprivileged user could send malicious requests to polkit, which could then cause the polkit daemon to corrupt its memory and crash. • http://lists.freedesktop.org/archives/polkit-devel/2015-July/000432.html http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00010.html http://lists.opensuse.org/opensuse-updates/2015-11/msg00042.html http://rhn.redhat.com/errata/RHSA-2016-0189.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html http://www.securityfocus.com/bid/77356 http://www.securitytracker.com/id/1035023 https://bugzilla.redhat.com/show_bug.cgi?id=1245684 https://access. • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.6EPSS: 0%CPEs: 5EXPL: 0CVE-2015-4625
https://notcve.org/view.php?id=CVE-2015-4625
Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value. Desbordamiento de entero en la función authentication_agent_new_cookie en PolicyKit (también conocido como polkit) en versiones anteriores a 0.113 permite a usuarios locales obtener privilegios mediante la creación de un número de conexiones grande, lo que desencadena la emisión de un valor de cookie duplicado. • http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161721.html http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162294.html http://lists.freedesktop.org/archives/polkit-devel/2015-July/000432.html http://lists.freedesktop.org/archives/polkit-devel/2015-June/000427.html http://lists.freedesktop.org/archives/polkit-devel/2015-May/000419.html http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00010.html http://lists.opensuse.org/opensuse-updates/2015-11/msg0 • CWE-189: Numeric Errors •