Description
The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | policykit-1 | 0.105-11 | — |
| Debian 13 | policykit-1 | 0.105-11 | — |
| Debian 12 | policykit-1 | 0.105-11 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | policykit-1 | 0.105-20ubuntu0.18.04.1 | USN-3717-1 |
| Ubuntu 16.04 LTS | policykit-1 | 0.105-14.1ubuntu0.1 | USN-3717-1 |
| Ubuntu 14.04 LTS | policykit-1 | 0.105-4ubuntu3.14.04.2 | USN-3717-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | polkit | 0.113-4.1 | SUSE-SU-2015:1838-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 | polkit | 0.113-4.1 | SUSE-SU-2015:1838-1 |
Advisories 2
- USN-3717-1 policykit-1 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- SUSE-SU-2015:1838-1 Security update for polkit SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [polkit-devel] 20150529 Crash authentication_agent_new with invalid object path in RegisterAuthenticationAgent mailing-list
- USN-3717-1 vendor-advisory
- FEDORA-2015-11058 vendor-advisory
- openSUSE-SU-2015:1927 vendor-advisory
- FEDORA-2015-11743 vendor-advisory
- [polkit-devel] 20150702 polkit-0.113 released mailing-list
- 76086 vdb-entry
- openSUSE-SU-2015:1734 vendor-advisory
- 1035023 vdb-entry
- [polkit-devel] 20150630 Crash authentication_agent_new with invalid object path in RegisterAuthenticationAgent mailing-list