Summary
Kevin Backhouse discovered that polkit incorrectly handled errors in the
polkit_system_bus_name_get_creds_sync function. A local attacker could
possibly use this issue to escalate privileges.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | policykit-1 | 0.105-26ubuntu1.1 |
Vulnerabilities 1
-
High 7.8
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privil…
KEV May 12, 2023
References
-
report
https://ubuntu.com/security/CVE-2021-3560