oss-security - Re: pwnkit: Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABEVAa2T604XknM=iC01OVRciWVCiTKJxuNS=RRtWhGpUWmwnw@mail.gmail.com>
Date: Wed, 26 Jan 2022 13:54:45 +0100
From: Dominik Czarnota <dominik.b.czarnota@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: pwnkit: Local Privilege Escalation in polkit's
 pkexec (CVE-2021-4034)

Hi,

And many other binaries also do things incorrectly:
- https://grep.app/search?q=%3D%201%3B%20n%20%3C%20argc
- https://grep.app/search?q=%3D%201%3B%20.%20%3C%20argc&regexp=true

But most of them are not suid binaries and also do not perform a write into
argv[].

Cheers,
Disconnect3d

On Wed, 26 Jan 2022 at 13:52, Matthias Schmidt <oss-sec@...c.org> wrote:

> Hi,
>
> * Qualys Security Advisory wrote:
> >
> > Qualys Security Advisory
> >
> > pwnkit: Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)
>
> This was already mentioned in 2013 in a blog post, however, it seems the
> author didn't realize the consequences of their finding:
>
> https://ryiron.wordpress.com/2013/12/16/argv-silliness/
>
> Cheers
>
>         Matthias
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.