[Bug 256405] sysutils/polkit: Update to 0.119

From: <bugzilla-noreply_at_freebsd.org>
Date: Fri, 04 Jun 2021 18:30:28 +0000

--- Comment #3 from commit-hook_at_FreeBSD.org ---
A commit in branch main references this bug:


commit 0958ffc12c9c0bba44f9a1adc0ca5173d7cd8bf9
Author:     Tobias C. Berner <tcberner_at_FreeBSD.org>
AuthorDate: 2021-06-04 18:27:49 +0000
Commit:     Tobias C. Berner <tcberner_at_FreeBSD.org>
CommitDate: 2021-06-04 18:29:52 +0000

    security/vuxml: document vulnerability in sysutils/polkit

    Cedric Buissart reports:

            The function `polkit_system_bus_name_get_creds_sync` is used to get
            uid and pid of the process requesting the action. It does this by
            sending the unique bus name of the requesting process, which is
            typically something like ":1.96", to `dbus-daemon`. These unique
            are assigned and managed by `dbus-daemon` and cannot be forged, so
            is a good way to check the privileges of the requesting process.

            The vulnerability happens when the requesting process disconnects
            `dbus-daemon` just before the call to
            `polkit_system_bus_name_get_creds_sync` starts. In this scenario,
            unique bus name is no longer valid, so `dbus-daemon` sends back an
            reply. This error case is handled in
            `polkit_system_bus_name_get_creds_sync` by setting the value of the
            `error` parameter, but it still returns `TRUE`, rather than
            This behavior means that all callers of
            `polkit_system_bus_name_get_creds_sync` need to carefully check
            an error was set. If the calling function forgets to check for
            then it will think that the uid of the requesting process is 0
            the `AsyncGetBusNameCredsData` struct is zero initialized). In
            words, it will think that the action was requested by a root
            and will therefore allow it.

    PR:             256405
    Security:       CVE-2021-3560 polkit

 security/vuxml/vuln.xml | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

You are receiving this mail because:
You are the assignee for the bug.
Received on Fri Jun 04 2021 - 18:30:28 UTC

Original text of this message