Unprivileged attackers can get a root shell by exploiting an authentication bypass vulnerability in the polkit auth system service installed by default on many modern Linux distributions.
The polkit local privilege escalation bug (tracked as CVE-2021-3560) was publicly disclosed, and a fix was released on June 3, 2021.
It was introduced seven years ago in version 0.113 and was only recently discovered by GitHub Security Lab security researcher Kevin Backhouse.
Even though many Linux distributions haven't shipped with the vulnerable polkit version until recently, any Linux system shipping with polkit 0.113 or later installed is exposed to attacks.
The list of currently vulnerable distros shared by Backhouse includes popular distros such as RHEL 8, Fedora 21 (or later), Ubuntu 20.04, as well as unstable versions like Debian testing ('bullseye') and its derivatives.
Exploiting the vulnerability is surprisingly easy as it only takes a few terminal commands using only standard tools such as bash, kill, and dbus-send — a video demo provided by Backhouse is embedded below.
"When a requesting process disconnects from dbus-daemon just before the call to polkit_system_bus_name_get_creds_sync starts, the process cannot get a unique uid and pid of the process and it cannot verify the privileges of the requesting process," Red Hat's security advisory explains.
"The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability."
He also says that the vulnerability is "very simple and quick to exploit, so it’s important that you update your Linux installations as soon as possible."
Technical details on polkit architecture and how to exploit the vulnerability are provided by the security researcher in this blog post.
Linux users: please upgrade polkit to get the fix for CVE-2021-3560. More details in a blog post later this week. https://t.co/NCNY2s6O5g
— Kevin Backhouse (@kevin_backhouse) June 7, 2021
In related news, GRIMM researchers also discovered 15-year-old vulnerabilities in the iSCSI subsystem of the Linux kernel affecting all Linux distributions.
Luckily, the vulnerable kernel module is not loaded by default, but attackers can load and exploit the buggy kernel module themselves.
The flaws also allow local attackers with basic user privileges to gain root privileges on unpatched Linux systems.
.jpg)
Comments
redwolfe_98 - 2 years ago
the title is using incorrect grammar. it should be "let," as in past tense.
serghei - 2 years ago
It still lets you on unpatched systems.
redwolfe_98 - 2 years ago
the youtube video is not playing, for me. i use the chrome browser with the ublock origin and noscript browser-extensions. it is the same with the MS edge-browser, which is just chrome, rebranded.
'not sure where the problem is but i am thinking that some coding in the webpages needs to be changed in order to accomodate the latest versions of the chrome browser.
serghei - 2 years ago
Works fine on all my desktop and mobile devices. The problem is likely on your end.
Mike_Walsh - 2 years ago
Heh. In 'Puppy' Linux, WE run as root ALL THE TIME.....!!! Never given any issues yet, 'cos even if you're doing anything "sensitive", you can set the session to evaporate into cyberspace when you shut-down....
(*shrug*)