Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 27 Jan 2022 13:45:33 +0100
From: Kai Lüke <>
Subject: Re: pwnkit: Local Privilege Escalation in polkit's
 pkexec (CVE-2021-4034)

> Dominik Czarnota:
> And many other binaries also do things incorrectly

The setuid binary polkit-agent-helper-1 has checks in place for argc
in the usual code paths but when it's not executed with euid 0 (i.e.,
it's not setuid), there is an argv[0] deref through printf which
luckily handles gracefully and prints "(null)" instead:
  polkit-agent-helper-1: needs to be setuid root
  PAM_ERROR_MSG Incorrect permissions on (null) (needs to be setuid root)

I wonder however, if the amount of setuid binaries couldn't be
reduced, in this case by offloading the PAM auth check to the polkit
daemon again (which could verify the client's programs uid through the
Unix Domain Socket).

An alternative to pkexec that is not setuid but also uses polkit auth
is systemd-run (here is an attempt at mimicking the sudo UX:

Kinvolk GmbH | Adalbertstr.6a, 10999 Berlin | tel: +491755589364

Geschäftsführer/Directors: Benjamin Owen Orndorff

Registergericht/Court of registration: Amtsgericht Charlottenburg

Registernummer/Registration number: HRB 171414 B

Ust-ID-Nummer/VAT ID number: DE302207000

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.