CVE-2018-1116

Se ha descubierto un problema en versiones anteriores a la 0.116 de polkit. La implementación de la función polkit_backend_interactive_authority_check_authorization en polkitd permite probar la autenticación y desencadenar la autenticación de procesos no relacionados propiedad de otros usuarios. Esto podría resultar en una denegación de servicio (DoS) local y una divulgación de información.

It was found that Polkit's CheckAuthorization and RegisterAuthenticationAgent D-Bus calls did not validate the client provided UID. A specially crafted program could use this flaw to submit arbitrary UIDs, triggering various denial of service or minor disclosures, such as which authentication is cached in the victim's session.

Tavis Ormandy discovered that PolicyKit incorrectly handled certain invalid object paths. A local attacker could possibly use this issue to cause PolicyKit to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. It was discovered that PolicyKit incorrectly handled certain duplicate action IDs. A local attacker could use this issue to cause PolicyKit to crash, resulting in a denial of service, or possibly escalate privileges. This issue only affected Ubuntu 14.04 LTS. Various other issues were also addressed.