Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

A local attacker can bypass the security policy of polkit, in
order to escalate his privileges.

Impacted products: Fedora, MBS, RHEL, Unix (platform)

Severity: 2/4

Creation date: 20/09/2013

DESCRIPTION OF THE VULNERABILITY

The PolicyKit feature defines a security policy, so unprivileged
processes are allowed to communicate with privileged processes.

In order to do so, polkit receives the couple PID, startup_time
from the client. It then reads /proc/PID/status, in order to
determine the UID of the client process. However, if the client
started a suid process, the returned UID is different from the
real user.

A local attacker can therefore bypass the security policy of
polkit, in order to escalate his privileges.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/polkit-privilege-escalation-13454