Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1228738 (CVE-2015-3218) - CVE-2015-3218 polkit: crash authentication_agent_new with invalid object path in RegisterAuthenticationAgent
Summary: CVE-2015-3218 polkit: crash authentication_agent_new with invalid object path...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2015-3218
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1228739
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-06-05 14:50 UTC by Vasyl Kaigorodov
Modified: 2021-06-11 21:04 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A NULL-pointer dereference flaw was discovered in polkitd. A malicious, local user could exploit this flaw to crash polkitd.
Clone Of:
Environment:
Last Closed: 2021-06-11 21:04:14 UTC
Embargoed:

Attachments (Terms of Use)

Description Vasyl Kaigorodov 2015-06-05 14:50:11 UTC 
It was reported that polkitd dumps core if you set an invalid object
path when calling RegisterAuthenticationAgent.
It allows local authenticated users to perform a denial of service attack.
Original report: http://lists.freedesktop.org/archives/polkit-devel/2015-May/000420.html
SUggested patch is available: http://lists.freedesktop.org/archives/polkit-devel/2015-May/000421.html
Comment 1 Vasyl Kaigorodov 2015-06-05 14:50:47 UTC 
Created polkit tracking bugs for this issue:

Affects: fedora-all [bug 1228739]
Comment 2 Stefan Cornelius 2015-06-19 15:09:49 UTC 
Commit fixing this:
http://cgit.freedesktop.org/polkit/commit/src/polkitbackend/polkitbackendinteractiveauthority.c?id=48e646918efb2bf0b3b505747655726d7869f31c
Comment 3 Stefan Cornelius 2015-06-19 17:11:03 UTC 
It looks like this was introduced via http://cgit.freedesktop.org/polkit/commit/?id=6eeb077bc90c9c7783360a526b2f04645b1b0848

In authentication_agent_new():
>  error = NULL;
>  agent->proxy = g_dbus_proxy_new_for_bus_sync (
>                                       <snip>various params</snip>
>                                                &error);
>  if (agent->proxy == NULL)
>    {
>      g_warning ("Error constructing proxy for agent: %s", error->message);

error can still be NULL after the call to g_dbus_proxy_new_for_bus_sync(). In that case we crash when trying to dereference error->message.

The version in RHEL6 does not have this commit and is not affected. RHEL7 is affected.
Comment 5 Fedora Update System 2015-07-13 19:08:52 UTC 
polkit-0.113-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2015-07-21 08:23:36 UTC 
polkit-0.113-4.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Product Security DevOps Team 2021-06-11 21:04:14 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2015-3218
Note You need to log in before you can comment on or make changes to this bug.