Unprivileged attackers can get a root shell by exploiting an authentication bypass vulnerability in the polkit auth system service installed by default on many modern Linux distributions.
The polkit local privilege escalation bug (tracked as CVE-2021-3560) was publicly disclosed, and a fix was released on June 3, 2021.
Even though many Linux distributions haven’t shipped with the vulnerable polkit version until recently, any Linux system shipping with polkit 0.113 or later installed is exposed to attacks.
The list of currently vulnerable distros shared by Backhouse includes popular distros such as RHEL 8, Fedora 21 (or later), Ubuntu 20.04, as well as unstable versions like Debian testing (‘bullseye’) and its derivatives.
Exploiting the vulnerability is surprisingly easy as it only takes a few terminal commands using only standard tools such as bash, kill, and dbus-send — a video demo provided by Backhouse is embedded below.
“When a requesting process disconnects from dbus-daemon just before the call to polkit_system_bus_name_get_creds_sync starts, the process cannot get a unique uid and pid of the process and it cannot verify the privileges of the requesting process,” Red Hat’s security advisory explains.
“The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.”
He also says that the vulnerability is “very simple and quick to exploit, so it’s important that you update your Linux installations as soon as possible.”
Technical details on polkit architecture and how to exploit the vulnerability are provided by the security researcher in this blog post.
Linux users: please upgrade polkit to get the fix for CVE-2021-3560. More details in a blog post later this week. https://t.co/NCNY2s6O5g
In related news, GRIMM researchers also discovered 15-year-old vulnerabilities in the iSCSI subsystem of the Linux kernel affecting all Linux distributions.
Luckily, the vulnerable kernel module is not loaded by default, but attackers can load and exploit the buggy kernel module themselves.
The flaws also allow local attackers with basic user privileges to gain root privileges on unpatched Linux systems.
