高危
polkit特权提升漏洞
2021-06-03 07:00:00 公开 ，2025-10-22 00:19:37 更新
- 关键漏洞
- CISA KEV
- 本地
- 公开PoC
- CWE Top 25 (2023)
- 开源组件漏洞
- CWE Top 25 (2024)
风险信息
- CVSS v2 向量
- AV:L/AC:L/Au:N/C:C/I:C/A:C
- CVSS v2 风险值
- 7.2
- CVSS v3 向量
- AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3 风险值
- 7.8
- CVSS v3.1 向量
- AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3.1 风险值
- 7.8
详细信息
- 漏洞类型
- 权限许可和访问控制问题
- 漏洞描述
- polkit是一个在类Unix操作系统中控制系统范围权限的组件。通过定义和审核权限规则，实现不同优先级进程间的通讯。polkit存在安全漏洞，该漏洞源于当请求进程在调用polkit_system_bus_name_get_creds_sync之前断开与dbus-daemon的连接时，该进程无法获得进程的唯一uid和pid，也无法验证请求进程的特权，可能会被诱骗绕过D-Bus请求的凭据检查，从而将请求者的权限提升到root用户。此漏洞可能被无特权的本地攻击者用来创建新的本地管理员。
- 修复建议
- polkit 0.119已经修复此漏洞，补丁获取链接： https://gitlab.freedesktop.org/polkit/polkit/-/commit/a04d13a
参考链接
- https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/
OSV · Third Party Advisory · Exploit
- https://bugzilla.redhat.com/show_bug.cgi?id=1961710
OSV · Issue Tracking · Patch · Vendor Advisory
- https://www.cybersecurity-help.cz/vdb/SB2021060718
- https://vigilance.fr/vulnerability/polkit-privilege-escalation-via-polkit-system-bus-name-get-creds-sync-35615
- https://www.auscert.org.au/bulletins/ESB-2021.1928
- https://packetstormsecurity.com/files/165088/Polkit-Authentication-Bypass-Local-Privilege-Escalation.html
- https://www.cybersecurity-help.cz/vdb/SB2021060912
- https://packetstormsecurity.com/files/163452/Polkit-D-Bus-Authentication-Bypass.html
- https://www.cybersecurity-help.cz/vdb/SB2021071314
- https://www.auscert.org.au/bulletins/ESB-2021.2657
- https://packetstormsecurity.com/files/163142/Polkit-0.105-26-0.117-2-Privilege-Escalation.html
- https://www.auscert.org.au/bulletins/ESB-2021.2711
- https://packetstormsecurity.com/files/165313/Polkit-CVE-2021-3560-Overview.html
- https://www.auscert.org.au/bulletins/ESB-2021.1940
- https://www.auscert.org.au/bulletins/ESB-2021.2320
- https://packetstormsecurity.com/files/163400/Red-Hat-Security-Advisory-2021-2555-01.html
- https://www.exploit-db.com/exploits/50011
- https://packetstormsecurity.com/files/165230/Polkit-CVE-2021-3560-Research.html
- https://access.redhat.com/security/cve/cve-2021-3560
- https://www.cybersecurity-help.cz/vdb/SB2021062312
- https://www.cybersecurity-help.cz/vdb/SB2021070616
- https://www.auscert.org.au/bulletins/ESB-2021.2201
- https://packetstormsecurity.com/files/162940/Red-Hat-Security-Advisory-2021-2236-01.html
- https://packetstormsecurity.com/files/163488/Gentoo-Linux-Security-Advisory-202107-31.html
- https://www.cybersecurity-help.cz/vdb/SB2021122914
- https://packetstormsecurity.com/files/163242/Red-Hat-Security-Advisory-2021-2522-01.html
- http://packetstormsecurity.com/files/172846/Facebook-Fizz-Denial-Of-Service.html
OSV · VDB Entry · Third Party Advisory
- http://packetstormsecurity.com/files/172836/polkit-Authentication-Bypass.html
OSV · VDB Entry · Third Party Advisory
- https://osv.dev/vulnerability/CVE-2021-3560
OSV
- https://errata.rockylinux.org/RLSA-2021:2238
OSV
- https://osv.dev/vulnerability/RLSA-2021:2238
OSV
- https://security-tracker.debian.org/tracker/CVE-2021-3560
OSV
- https://ubuntu.com/security/CVE-2021-3560
OSV
- https://ubuntu.com/security/notices/USN-4980-1
OSV
- https://www.cve.org/CVERecord?id=CVE-2021-3560
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
OSV
- https://osv.dev/vulnerability/UBUNTU-CVE-2021-3560
OSV
- https://osv.dev/vulnerability/DEBIAN-CVE-2021-3560
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3560
NVD · US Government Resource