Permissions, Privileges, and Access Controls in polkit - CVE-2021-3560

Vulnerability identifier: #VU53837

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3560

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the "polkit_system_bus_name_get_creds_sync" function, which leads to security restrictions bypass and privilege escalation.

polkit
Arch Linux
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE MicroOS
SUSE Enterprise Storage
Anolis OS
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Workstation Extension
Slackware Linux
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
openEuler
Ubuntu
Fedora
cri-o (Red Hat package)
redhat-release-virtualization-host (Red Hat package)
redhat-virtualization-host (Red Hat package)
openshift-kuryr (Red Hat package)
openshift-clients (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
libpolkit-agent-1-0 (Ubuntu package)
libpolkit-gobject-1-0 (Ubuntu package)
policykit-1 (Ubuntu package)
polkit-devel-debuginfo
polkit-devel
libpolkit0
libpolkit0-debuginfo
polkit
polkit-debuginfo
polkit-debugsource
typelib-1_0-Polkit-1_0
libpolkit0-32bit
libpolkit0-debuginfo-32bit
polkit (Red Hat package)
polkit-libs
polkit-docs
polkit-help
Red Hat Virtualization Host
Red Hat Virtualization
OpenShift Virtualization
Red Hat OpenShift Container Platform
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)

Install updates from vendor's website.

polkit - update to 0.119
cri-o (Red Hat package) - addressed in versions 1.20.3-6.rhaos4.7.git0d0f863.el7, 1.20.3-6.rhaos4.7.git0d0f863.el8
redhat-release-virtualization-host (Red Hat package) - update to 4.4.6-2.el8ev
redhat-virtualization-host (Red Hat package) - update to 4.4.6-20210615.0.el8_4
Red Hat OpenShift Container Platform - update to 4.7.19
openshift-kuryr (Red Hat package) - update to 4.7.0-202106232224.p0.git.c7654fb.el8
openshift-clients (Red Hat package) - addressed in versions 4.7.0-202106252127.p0.git.8b4b094.el7, 4.7.0-202106252127.p0.git.8b4b094.el8
libpolkit-agent-1-0 (Ubuntu package) - addressed in versions 0.105-26ubuntu1.1, 0.105-29ubuntu0.1, 0.105-30ubuntu0.1
libpolkit-gobject-1-0 (Ubuntu package) - addressed in versions 0.105-26ubuntu1.1, 0.105-29ubuntu0.1, 0.105-30ubuntu0.1
policykit-1 (Ubuntu package) - addressed in versions 0.105-26ubuntu1.1, 0.105-29ubuntu0.1, 0.105-30ubuntu0.1
polkit-devel-debuginfo - addressed in versions 0.113-5.21.1, 0.114-3.12.1, 0.116-3.3.1
polkit-devel - addressed in versions 0.113-5.21.1, 0.114-3.12.1, 0.116-3.3.1
libpolkit0 - addressed in versions 0.113-5.21.1, 0.114-3.12.1, 0.116-3.3.1
libpolkit0-debuginfo - addressed in versions 0.113-5.21.1, 0.114-3.12.1, 0.116-3.3.1
polkit - addressed in versions 0.113-5.21.1, 0.114-3.12.1, 0.116-3.3.1
polkit-debuginfo - addressed in versions 0.113-5.21.1, 0.114-3.12.1, 0.116-3.3.1
polkit-debugsource - addressed in versions 0.113-5.21.1, 0.114-3.12.1, 0.116-3.3.1
typelib-1_0-Polkit-1_0 - addressed in versions 0.113-5.21.1, 0.114-3.12.1, 0.116-3.3.1
libpolkit0-32bit - update to 0.113-5.21.1
libpolkit0-debuginfo-32bit - update to 0.113-5.21.1
polkit (Red Hat package) - addressed in versions 0.115-9.el8_1.1, 0.115-11.el8_2.1, 0.115-11.el8_4.1
polkit - update to 0.115-11
polkit-devel - update to 0.115-11
polkit-libs - update to 0.115-11
polkit-docs - update to 0.115-11
polkit-help - update to 0.116-7
polkit-libs - update to 0.116-7
polkit-debugsource - update to 0.116-7
polkit-devel - update to 0.116-7
polkit-debuginfo - update to 0.116-7
polkit - update to 0.116-7
polkit - addressed in versions 0.117-2.fc33.1, 0.117-3.fc34.1
OpenShift Virtualization - addressed in versions 2.6.6, 4.8.0
Dell EMC Unity Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity XT Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity VSA Operating Environment (OE) - update to 5.1.2.0.5.007

• Exploit #8549 - CVE-2021-3560 (Polkit Exploit (CVE-2021-3560), no download capabilty? Copy and paste it!) (October 29, 2022)
• Exploit #8336 - XDR-PoC (Supporting programs that leverage efforts to research Cortex XDR) (September 4, 2022)
• Exploit #7906 - CVE-2021-3560-Authentication-Agent (PolicyKit CVE-2021-3560 Exploit (Authentication Agent)) (May 27, 2022)
• Exploit #7905 - CVE-2021-3560 (PolicyKit CVE-2021-3560 Exploitation (Authentication Agent)) (May 27, 2022)
• Exploit #7853 - exploit-CVE-2021-3560 (Exploit for CVE-2021-3560 (Polkit) - Local Privilege Escalation) (May 17, 2022)
• Exploit #7536 - CVE-2021-3560 (Script en python sobre la vulnerabilidad CVE-2021-3560) (March 24, 2022)
• Exploit #7351 - CVE-2021-3560-Polkit-DBus (f4T1H's PoC script for CVE-2021-3560 Polkit D-Bus Privilege Escalation) (February 14, 2022)
• Exploit #7308 - CVE-2021-3560 (CVE-2021-3560 analysis) (January 31, 2022)
• Exploit #7028 - CVE-2021-3560 (CVE-2021-3560 (Polkit - Local Privilege Escalation)) (November 16, 2021)
• Exploit #6655 - polkit-auto-exploit (Automatic Explotation PoC for Polkit CVE-2021-3560) (August 25, 2021)
• Exploit #6591 - CVE-2021-3560 (Polkit D-Bus Authentication Bypass Exploit) (August 1, 2021)
• Exploit #6589 - CVE-2021-3560 (Polkit D-Bus Authentication Bypass Exploit) (August 1, 2021)
• Exploit #6573 - CVE-2021-3560 (NYCY_homework_&_meeting) (July 29, 2021)
• Exploit #6566 - CVE-2021-3560 (Polkit - Local Privilege Escalation (CVE-2021-3560)) (July 26, 2021)
• Exploit #6527 - Polkit D-Bus Authentication Bypass (July 9, 2021)
• Exploit #6515 - CVE-2021-3560_PoC (polkit exploit script v1.0) (July 4, 2021)
• Exploit #6483 - Polkit-CVE-2021-3560 () (June 29, 2021)
• Exploit #6455 - Polkit-exploit (Privilege escalation with polkit - CVE-2021-3560) (June 20, 2021)
• Exploit #5574 - Polkit 0.105-26 0.117-2 - Local Privilege Escalation (June 17, 2021)
• Exploit #5567 - CVE-2021-3560-Polkit-Privilege-Esclation () (June 16, 2021)
• Exploit #5563 - CVE-2021-3560_PoC (polkit exploit script v1.0) (June 15, 2021)
• Exploit #5560 - CVE-2021-3560 (CVE-2021-3560 (Polkit - Local Privilege Escalation)) (June 13, 2021)
• Exploit #5558 - CVE-2021-3560 (a reliable C based exploit and writeup for CVE-2021-3560.) (June 13, 2021)
• Exploit #5557 - polkadots (CVE-2021-3560 Local PrivEsc Exploit) (June 13, 2021)

• https://seclists.org/oss-sec/2021/q2/180
• https://gitlab.freedesktop.org/polkit/polkit/-/commit/a04d13a

• Privilege escalation in Polkit
• Slackware Linux update for polkit
• Red Hat Enterprise Linux 8.1 update for polkit
• Red Hat Enterprise Linux 8.2 update for polkit
• Red Hat Enterprise Linux 8.4 update for polkit
• Arch Linux update for polkit
• Red Hat Virtualization Host security update for ovirt
• Multiple vulnerabilities in OpenShift Container Platform 4.7
• Gentoo update for polkit
• Multiple vulnerabilities in Dell EMC Unity
• SUSE update for polkit
• SUSE update for polkit
• SUSE update for polkit
• Ubuntu update for policykit-1
• openEuler 20.03 LTS SP1 update for polkit
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in OpenShift Virtualization 2.6
• Fedora 33 update for polkit
• Fedora 34 update for polkit
• Anolis OS update for polkit (Anolis OS 8.2)
• Anolis OS update for polkit (Anolis OS 8.4)