Red Hat Polkit Incorrect Authorization Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-05-12
• EPSS: 24% chance of exploitation in the next 30 days (higher than 98% of CVEs)

[ Description ]Official description

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CISA: Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 2 Jun 2023): Apply updates per vendor instructions.

• Patch on bugzilla.redhat.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• packetstormsecurity.com/files/172836/polkit-Authentication-Bypass.htmlThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/172846/Facebook-Fizz-Denial-Of-Service.htmlThird Party AdvisoryVDB Entry
• bugzilla.redhat.com/show_bug.cgiIssue TrackingPatchVendor Advisory
• github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bugExploitThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource