A vulnerability in polkit could lead to local root privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-auth/polkit | * | < 0.120-r2 | >= 0.120-r2 |
polkit is a toolkit for managing policies related to unprivileged processes communicating with privileged process.
Flawed input validation of arguments was discovered in the 'pkexec' program's main() function.
A local attacker could achieve root privilege escalation.
Run the following command as root: # chmod 0755 /usr/bin/pkexec
Upgrade Polkit to a patched version.
# emerge --sync # emerge --ask --verbose ">=sys-auth/polkit-0.120-r2"
A vulnerability in polkit could lead to local root privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-auth/polkit | * | < 0.119 | >= 0.119 |
polkit is a toolkit for managing policies related to unprivileged processes communicating with privileged process.
The function polkit_system_bus_name_get_creds_sync() was called without checking for error, and as such temporarily treats the authentication request as coming from root.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All polkit users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-auth/polkit-0.119"
Multiple vulnerabilities have been found in polkit, the worst of which could result in privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-auth/polkit | * | < 0.115-r2 | >= 0.115-r2 |
polkit is a toolkit for managing policies relating to unprivileged processes communicating with privileged processes.
Multiple vulnerabilities have been discovered in polkit. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All polkit users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-auth/polkit-0.115-r2"
polkit is vulnerable to local privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-auth/polkit | * | < 0.113 | >= 0.113 |
polkit is a toolkit for managing policies relating to unprivileged processes communicating with privileged processes.
A vulnerability was discovered in polkit’s polkit_backend_action_pool_init function due to duplicate action IDs in action descriptions.
Local attackers are able to gain unauthorized privileges on the system.
There is no known workaround at this time.
All polkit users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-auth/polkit-0.113"
A race condition in polkit could allow a local attacker to gain escalated privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/libvirt | * | < 1.1.2-r3 | >= 1.1.2-r3 |
| net-misc/spice-gtk | * | < 0.21 | >= 0.21 |
| net-print/hplip | * | < 3.14.1 | >= 3.14.1 |
| sys-apps/systemd | * | < 204-r1 | >= 204-r1 |
| sys-auth/polkit | * | < 0.112 | >= 0.112 |
polkit is a toolkit for managing policies relating to unprivileged processes communicating with privileged processes.
polkit has a race condition which potentially allows a process to change its UID/EUID via suid or pkexec before authentication is completed.
A local attacker could start a suid or pkexec process through a polkit-enabled application, which could result in privilege escalation or bypass of polkit restrictions.
There is no known workaround at this time.
All polkit users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-auth/polkit-0.112"
All HPLIP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-print/hplip-3.14.1"
All Spice-Gtk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/spice-gtk-0.21"
All systemd users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/systemd-204-r1"
All libvirt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-1.1.2-r3"
Multiple vulnerabilities have been found in PolicyKit, the worst of which may allow a local attacker to gain root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-auth/polkit | * | < 0.104-r1 | >= 0.104-r1 |
PolicyKit is a toolkit for controlling privileges for system-wide services.
Multiple vulnerabilities have been found in PolicyKit:
A local attacker could gain elevated privileges or sensitive information.
There is no known workaround at this time.
All PolicyKit users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-auth/polkit-0.104-r1"