Seven-year-old make-me-root bug in Linux service polkit patched
(2021/06/11)
- Reference: 1623392893
- News link: https://www.theregister.co.uk/2021/06/11/linux_polkit_package_patched/
- Source link:
A seven-year-old privilege escalation vulnerability that's been lurking in several Linux distributions was patched last week in a coordinated disclosure.
In a [1]blog post on Thursday, GitHub security researcher Kevin Backhouse recounted how he found the bug ( [2]CVE-2021-3560 ) in a service called polkit associated with systemd, a common Linux system and service manager component.
Introduced in commit [3]bfa5036 seven years ago and initially shipped in polkit version 0.113, the bug traveled different paths in different Linux distributions. For example, it missed Debian 10 but it made it to the [4]unstable version of Debian , upon which other distros like Ubuntu are based.
[5]
Formerly known as PolicyKit, polkit is a service that evaluates whether specific Linux activities require higher privileges than those currently available. It comes into play if, for example, you try to create a new user account.
[6]
[7]
Backhouse says the flaw is surprisingly easy to exploit, requiring only a few commands using standard terminal tools like bash, kill, and dbus-send.
"The vulnerability is triggered by starting a dbus-send command but killing it while polkit is still in the middle of processing the request," explained Backhouse.
[8]
Killing dbus-send – an interprocess communication command – in the midst of an authentication request causes an error that arises from polkit asking for the UID of a connection that no longer exists (because the connection was killed).
[9]ALPACA gnaws through TLS protection to snarf cookies and steal data
[10]How to use Google's new dependency mapping tool to find security flaws buried in your projects
[11]OpenSSL shuts down two high-severity bugs: Flaws enable cert shenanigans, denial-of-service attacks
[12]Severe bug in Libgcrypt – used by GPG and others – is a whole heap of trouble, prompts patch scramble
"In fact, polkit mishandles the error in a particularly unfortunate way: rather than rejecting the request, it treats the request as though it came from a process with UID 0," explains Backhouse. "In other words, it immediately authorizes the request because it thinks the request has come from a root process."
This doesn't happen all the time, because polkit's UID query to the dbus-daemon occurs multiple times over different code paths. Usually, those code paths handle the error correctly, said Backhouse, but one code path is vulnerable – and if the disconnection happens when that code path is active, that's when the privilege elevation occurs. It's all a matter of timing, which varies in unpredictable ways because multiple processes are involved.
The intermittent nature of the bug, Backhouse speculates, is why it remained undetected for seven years.
Linux systems that have polkit version 0.113 or later installed – like [13]Debian (unstable) , [14]RHEL 8 , [15]Fedora 21+ , and [16]Ubuntu 20.04 – are affected.
[17]
"CVE-2021-3560 enables an unprivileged local attacker to gain root privileges," said Backhouse. "It’s very simple and quick to exploit, so it’s important that you update your Linux installations as soon as possible." ®
Get our [18]Tech Resources
[1] https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/
[2] https://access.redhat.com/security/cve/CVE-2021-3560
[3] https://gitlab.freedesktop.org/polkit/polkit/-/commit/bfa5036bfb93582c5a87c44b847957479d911e38
[4] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989429
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YMM0Q4Jil17InO4Qh4KzNgAAAM4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMM0Q4Jil17InO4Qh4KzNgAAAM4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YMM0Q4Jil17InO4Qh4KzNgAAAM4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMM0Q4Jil17InO4Qh4KzNgAAAM4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2021/06/10/alpaca_tls_protection/
[10] https://www.theregister.com/2021/06/04/google_open_source_insights/
[11] https://www.theregister.com/2021/03/25/openssl_bug_fix/
[12] https://www.theregister.com/2021/01/29/severe_libgcrypt_bug/
[13] https://security-tracker.debian.org/tracker/CVE-2021-3560
[14] https://access.redhat.com/errata/RHSA-2021:2238
[15] https://bugzilla.redhat.com/show_bug.cgi?id=1967424
[16] https://ubuntu.com/security/notices/USN-4980-1
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YMM0Q4Jil17InO4Qh4KzNgAAAM4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[18] https://whitepapers.theregister.com/
In a [1]blog post on Thursday, GitHub security researcher Kevin Backhouse recounted how he found the bug ( [2]CVE-2021-3560 ) in a service called polkit associated with systemd, a common Linux system and service manager component.
Introduced in commit [3]bfa5036 seven years ago and initially shipped in polkit version 0.113, the bug traveled different paths in different Linux distributions. For example, it missed Debian 10 but it made it to the [4]unstable version of Debian , upon which other distros like Ubuntu are based.
[5]
Formerly known as PolicyKit, polkit is a service that evaluates whether specific Linux activities require higher privileges than those currently available. It comes into play if, for example, you try to create a new user account.
[6]
[7]
Backhouse says the flaw is surprisingly easy to exploit, requiring only a few commands using standard terminal tools like bash, kill, and dbus-send.
"The vulnerability is triggered by starting a dbus-send command but killing it while polkit is still in the middle of processing the request," explained Backhouse.
[8]
Killing dbus-send – an interprocess communication command – in the midst of an authentication request causes an error that arises from polkit asking for the UID of a connection that no longer exists (because the connection was killed).
[9]ALPACA gnaws through TLS protection to snarf cookies and steal data
[10]How to use Google's new dependency mapping tool to find security flaws buried in your projects
[11]OpenSSL shuts down two high-severity bugs: Flaws enable cert shenanigans, denial-of-service attacks
[12]Severe bug in Libgcrypt – used by GPG and others – is a whole heap of trouble, prompts patch scramble
"In fact, polkit mishandles the error in a particularly unfortunate way: rather than rejecting the request, it treats the request as though it came from a process with UID 0," explains Backhouse. "In other words, it immediately authorizes the request because it thinks the request has come from a root process."
This doesn't happen all the time, because polkit's UID query to the dbus-daemon occurs multiple times over different code paths. Usually, those code paths handle the error correctly, said Backhouse, but one code path is vulnerable – and if the disconnection happens when that code path is active, that's when the privilege elevation occurs. It's all a matter of timing, which varies in unpredictable ways because multiple processes are involved.
The intermittent nature of the bug, Backhouse speculates, is why it remained undetected for seven years.
Linux systems that have polkit version 0.113 or later installed – like [13]Debian (unstable) , [14]RHEL 8 , [15]Fedora 21+ , and [16]Ubuntu 20.04 – are affected.
[17]
"CVE-2021-3560 enables an unprivileged local attacker to gain root privileges," said Backhouse. "It’s very simple and quick to exploit, so it’s important that you update your Linux installations as soon as possible." ®
Get our [18]Tech Resources
[1] https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/
[2] https://access.redhat.com/security/cve/CVE-2021-3560
[3] https://gitlab.freedesktop.org/polkit/polkit/-/commit/bfa5036bfb93582c5a87c44b847957479d911e38
[4] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989429
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YMM0Q4Jil17InO4Qh4KzNgAAAM4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMM0Q4Jil17InO4Qh4KzNgAAAM4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YMM0Q4Jil17InO4Qh4KzNgAAAM4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMM0Q4Jil17InO4Qh4KzNgAAAM4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2021/06/10/alpaca_tls_protection/
[10] https://www.theregister.com/2021/06/04/google_open_source_insights/
[11] https://www.theregister.com/2021/03/25/openssl_bug_fix/
[12] https://www.theregister.com/2021/01/29/severe_libgcrypt_bug/
[13] https://security-tracker.debian.org/tracker/CVE-2021-3560
[14] https://access.redhat.com/errata/RHSA-2021:2238
[15] https://bugzilla.redhat.com/show_bug.cgi?id=1967424
[16] https://ubuntu.com/security/notices/USN-4980-1
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YMM0Q4Jil17InO4Qh4KzNgAAAM4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[18] https://whitepapers.theregister.com/
Kettle3D
This is true. But when most people these days refer to 'Linux' they are talking about the bulk of GNU/Linux distributions, and even in some cases FreeBSD.
It's like how you 'Google' something on Bing, or, increasingly commonly, call a Windows laptop a 'chromebook' and an ODT document a 'Word document'. Doesn't matter if you made it in LibreOffice or OpenOffice or Google Docs or manually wrote it in Notepad.
Kernel
diodesign
Yeah, sorry, mea culpa. I hastily wrote the headline at the end of the day and used kernel and not service. It's fixed. Don't forget to email corrections@theregister.com if you spot anything wrong, though.
C.
Brewster's Angle Grinder
Kernel in waiting?
Linux Alternatives
Logiker72
OpenBSD
FreeBSD
seL4
Re: Linux Alternatives
oiseau
OpenBSD
FreeBSD
seL4
Devuan Linux
O.
Re: Linux Alternatives
Anonymous Coward
Windows 10
.
(see icon)
That good old Unix philosophy.
Tom 7
Do one thing and do it well but use lots of different paths to get there....
Anonymous Coward
Does polkit still use javascript to define its rules? Even from the perspective of a full-time JS developer, this is a stupid thing to do. Javascript doesn't have any business inside something that claims to manage user privileges at the system level.
Brewster's Angle Grinder
Apparently. But it's Ecmascript 5. So it's javascript so old you're going to be wracking you brains to remember how it used to work and constantly cursing missing library functions.
As much as Lennart would like them to be, systemd and polkit are not "Linux kernel"