Command injection in PolicyKit - CVE-2018-19788

Vulnerability identifier: #VU16313

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-19788

CWE-ID: CWE-77

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local authenticated attacker to execute arbitrary commands on the target system.

The vulnerability exists due to PolicyKit's improper validation of permission requests for any low-privileged user with UID greater than INT_MAX, a constant in computer programming that defines what maximum value an integer variable can store, which equals to 2147483647 (in hexadecimal 0x7FFFFFFF). A local authenticated attacker with a uid greater than INT_MAX can execute any systemctl command.

PolicyKit
Debian Linux
Arch Linux
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
Opensuse
Fedora
linux-pam (Alpine package)
polkit
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)

The patch just refuses to initialize uid and gid values to negative. A nicer fix is to change the underlying type to e.g. gint64 to allow
the full range of values in uid_t and gid_t to be represented. But this cannot be done without breaking the API, so likely new functions
will have to be added (a polkit_unix_user_new variant that takes a gint64, and the same for _group_new, _set_uid, _get_uid, _set_gid,
_get_gid, etc.). This will require a bigger patch.

linux-pam (Alpine package) - update to 1.3.0-r1
polkit - addressed in versions 0.115-2.fc28, 0.115-4.1.fc29
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.0.0.5.116
Dell EMC Unity Operating Environment (OE) - update to 5.0.0.0.5.116

• Exploit #2360 - CVE-2018-19788 (Ansible role to check the vulnerability tracked as CVE-2018-19788, impacts PolicyKit version 0.115 which comes pre-installed on a wide range of Linux distributions) (April 7, 2020)
• Exploit #1969 - CVE-2018-19788 (Exploiting The CVE-2018-19788 PolicyKit Bug) (March 18, 2020)
• Exploit #2101 - CVE-2018-19788 (Silly easy exploit for CVE-2018-19788) (March 18, 2020)

• https://gitlab.freedesktop.org/polkit/polkit/issues/74

• Command execution in PolicyKit
• Debian update for policykit-1
• OpenSUSE Linux update for polkit
• Arch Linux update for polkit
• OpenSUSE Linux update for polkit
• Red Hat update for polkit
• Gentoo update for polkit
• Red Hat update for polkit
• Command injection in linux-pam (Alpine package)
• Multiple vulnerabilities in Dell EMC Unity Family
• Fedora 28 update for polkit
• Fedora 29 update for polkit