A 7-years-old authority intensify vulnerability found in the polkit system service could be abused by a malicious unauthorized local threat actor to bypass privilege and intensify permissions to the root users.
Tracked as CVE-2021-3560 (CVSS score: 7.8), the error damage polkit versions between 0.113 and 0.118 and was found by GitHub security investigators, who said the error was introduced in a code commit created on 9 Nov 2013. Red Hat’s Cedric Buissart reported that Debian-based distributions, based on Polkit 0.105, are also found to be vulnerable.
Polkit aka PolicyKit is a toolkit for describing and managing privileges in Linux distribution and is utilized for permitting unauthorized processes to transmit with authorized process.
“In case when a requesting process disconnects from dbus-daemon right before the call to polkit_system_bus_name_get_creds_sync starts, the procedure cannot get a unique uid and pid of the process and it cannot determine the privileges of the requesting process,” Red Hat said in an attack. “The biggest threat from this vulnerability is to information integrity and confidentiality as well as system susceptibility.
How Many Linux Distributions are Impacted with Polkit Vulnerability?
Some of the popular Linux distribution such as RHEL 8, Fedora 21 (or later), Debian “Bullseye,” and Ubuntu 20.04 are also impacted by the polkit vulnerability. The concern has been reducing in version 0.119, which was launched on 3 June.
How this Linux Flaw Permits the Unauthorized Users?
Linux inter-process communication (IPC) “dbus-send” mechanism that is used to send a message to D-Bus message bus, permitting transmission between multiple processes executing concurrently on the same machine. Polkit’s policy authority daemon is added as a service connected to system bys to authenticate crucial information securely.
While ending the given commands, it causes an authentication bypass because polkit unable to handles the terminated message and delight the request as though it comes from a process with root authorizations (UID 0), therefore authorizing the request instantly.
Researchers said “To bring out the vulnerable codepath, you have to disconnect at just the right moment and because there are various process involved, the time complexity of that ‘right moment’ lies between one run to the next. That’s the reason behind why the error was not found previously.”
Linux users are highly encouraged to update their Linux installation as soon as possible to mitigate any probable high risk coming out because of this seven-year-old polkiti error.
