Opened 5 years ago

Closed 5 years ago

#11692 closed enhancement (fixed)

Create security patch for polkit (CVE-2019-6133)

Reported by: Douglas R. Reno Owned by: Douglas R. Reno
Priority: high Milestone: 8.4
Component: BOOK Version: SVN
Severity: normal Keywords:
Cc:

Description

There is a security issue in polkit allowing for authentication bypass: 

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

​https://gitlab.freedesktop.org/polkit/polkit/commit/c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81#0cf68d1183ea5299db7cd71b8377fa3d29e1a63e

Change History (2)

comment:1 by Douglas R. Reno, 5 years ago

Owner: changed from blfs-book to Douglas R. Reno
Status: new → assigned

comment:2 by Douglas R. Reno, 5 years ago

Resolution: → fixed
Status: assigned → closed

Patch added at r3891 Fixed at r21228

Note: See TracTickets for help on using tickets.