Resource exhaustion in polkit - CVE-2021-4115

Vulnerability identifier: #VU61268

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-4115

CWE-ID: CWE-400

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to process file descriptor exhaustion in polkit. A local user can perform a denial of service (DoS) attack.

polkit
Arch Linux
Amazon Linux AMI
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Workstation Extension
Slackware Linux
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise High Performance Computing
openEuler
Ubuntu
Fedora
policykit-1 (Ubuntu package)
libpolkit0-32bit
libpolkit0-debuginfo-32bit
polkit-debugsource
polkit-debuginfo
polkit-devel
polkit-devel-debuginfo
libpolkit0
libpolkit0-debuginfo
polkit
typelib-1_0-Polkit-1_0
polkit-docs
polkit-libs
polkit (Red Hat package)
polkit-help
Red Hat Advanced Cluster Management for Kubernetes
OpenShift Virtualization
Red Hat OpenShift Container Platform

Install updates from vendor's website.

policykit-1 (Ubuntu package) - addressed in versions 0.105-26ubuntu1.3, 0.105-31ubuntu0.2
libpolkit0-32bit - update to 0.113-5.27.1
libpolkit0-debuginfo-32bit - update to 0.113-5.27.1
polkit-debugsource - addressed in versions 0.113-5.27.1, 0.116-3.9.1
polkit-debuginfo - addressed in versions 0.113-5.27.1, 0.116-3.9.1
polkit-devel - addressed in versions 0.113-5.27.1, 0.116-3.9.1
polkit-devel-debuginfo - addressed in versions 0.113-5.27.1, 0.116-3.9.1
libpolkit0 - addressed in versions 0.113-5.27.1, 0.116-3.9.1
libpolkit0-debuginfo - addressed in versions 0.113-5.27.1, 0.116-3.9.1
polkit - addressed in versions 0.113-5.27.1, 0.116-3.9.1
typelib-1_0-Polkit-1_0 - addressed in versions 0.113-5.27.1, 0.116-3.9.1
polkit-docs - update to 0.115-13
polkit-libs - update to 0.115-13
polkit-devel - update to 0.115-13
polkit - update to 0.115-13
polkit (Red Hat package) - update to 0.115-13.el8_5.2
polkit-debuginfo - update to 0.116-9
polkit-libs - update to 0.116-9
polkit-devel - update to 0.116-9
polkit-debugsource - update to 0.116-9
polkit-help - update to 0.116-9
polkit - update to 0.116-9
polkit - addressed in versions 0.117-3.fc34.3, 0.120-1.fc35.2
polkit - update to 0.117-10
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.3.10, 2.4.4
OpenShift Virtualization - update to 4.11.0
Red Hat OpenShift Container Platform - update to 4.11.0

• https://access.redhat.com/security/cve/cve-2021-4115
• https://gitlab.com/redhat/centos-stream/rpms/polkit/-/merge_requests/6/diffs?commit_id=bf900df04dc390d389e59aa10942b0f2b15c531e
• https://gitlab.freedesktop.org/polkit/polkit/-/issues/141
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VGKWCBS6IDZYYDYM2WIWJM5BL7QQTWPF/

• Denial of service in polkit
• Slackware Linux update for polkit
• Arch Linux update for polkit
• Red Hat Enterprise Linux 8 update for polkit
• Ubuntu update for policykit-1
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in OpenShift Virtualization
• SUSE update for polkit
• SUSE update for polkit
• openEuler update for polkit
• Amazon Linux AMI update for polkit
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• Fedora 35 update for polkit
• Fedora 34 update for polkit
• Anolis OS update for polkit