UBUNTU-CVE-2021-3560

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2021-3560
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-3560.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-3560
Related
Published
2021-06-03T07:00:00Z
Modified
2021-06-03T07:00:00Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

References

Affected packages

Ubuntu:20.04:LTS / policykit-1

Package

Name
policykit-1
Purl
pkg:deb/ubuntu/policykit-1@0.105-26ubuntu1.1?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.105-26ubuntu1.1

Affected versions

0.*

0.105-26ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "gir1.2-polkit-1.0": "0.105-26ubuntu1.1",
            "libpolkit-gobject-1-dev": "0.105-26ubuntu1.1",
            "libpolkit-agent-1-dev": "0.105-26ubuntu1.1",
            "libpolkit-gobject-1-0": "0.105-26ubuntu1.1",
            "libpolkit-gobject-1-0-dbgsym": "0.105-26ubuntu1.1",
            "libpolkit-agent-1-0-dbgsym": "0.105-26ubuntu1.1",
            "policykit-1-dbgsym": "0.105-26ubuntu1.1",
            "policykit-1-doc": "0.105-26ubuntu1.1",
            "libpolkit-agent-1-0": "0.105-26ubuntu1.1",
            "policykit-1": "0.105-26ubuntu1.1"
        }
    ]
}

Ubuntu:22.04:LTS / policykit-1

Package

Name
policykit-1
Purl
pkg:deb/ubuntu/policykit-1@0.105-31?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.105-31

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "gir1.2-polkit-1.0": "0.105-31",
            "libpolkit-gobject-1-dev": "0.105-31",
            "libpolkit-agent-1-dev": "0.105-31",
            "libpolkit-gobject-1-0": "0.105-31",
            "libpolkit-gobject-1-0-dbgsym": "0.105-31",
            "libpolkit-agent-1-0-dbgsym": "0.105-31",
            "policykit-1-dbgsym": "0.105-31",
            "policykit-1-doc": "0.105-31",
            "libpolkit-agent-1-0": "0.105-31",
            "policykit-1": "0.105-31"
        }
    ]
}