Search CVE reports


Toggle filters

1 – 10 of 15 results


CVE-2021-4115

Medium priority
Fixed

There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage...

1 affected packages

policykit-1

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
policykit-1 Not affected Fixed Not affected Not affected
Show less packages

CVE-2021-4034

High priority

Some fixes available 6 of 7

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The...

1 affected packages

policykit-1

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
policykit-1 Fixed Fixed Fixed Fixed
Show less packages

CVE-2021-3560

High priority
Fixed

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for...

1 affected packages

policykit-1

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
policykit-1 Fixed Fixed Not affected Not affected
Show less packages

CVE-2019-6133

Medium priority

Some fixes available 45 of 50

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking...

81 affected packages

linux, linux-aws, linux-aws-5.15, linux-aws-5.4, linux-aws-6.8...

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
linux Not affected Not affected Not affected Fixed Fixed
linux-aws Not affected Not affected Not affected Fixed Fixed
linux-aws-5.15 Not in release Not in release Not affected Not in release Not in release
linux-aws-5.4 Not in release Not in release Not in release Not affected Not in release
linux-aws-6.8 Not in release Not affected Not in release Not in release Not in release
linux-aws-fips Not in release Not in release Not in release Not in release Ignored
linux-aws-hwe Not in release Not in release Not in release Not in release Fixed
linux-azure Not affected Not affected Not affected Fixed Fixed
linux-azure-4.15 Not in release Not in release Not in release Not affected Not in release
linux-azure-5.15 Not in release Not in release Not affected Not in release Not in release
linux-azure-5.4 Not in release Not in release Not in release Not affected Not in release
linux-azure-6.8 Not in release Not affected Not in release Not in release Not in release
linux-azure-edge Not in release Not in release Not in release Fixed Not in release
linux-azure-fde Not in release Not affected Ignored Not in release Not in release
linux-azure-fde-5.15 Not in release Not in release Not affected Not in release Not in release
linux-azure-fips Not in release Not in release Not in release Not in release Ignored
linux-bluefield Not in release Not in release Not affected Not in release Not in release
linux-euclid Not in release Ignored
linux-fips Not in release Not in release Not in release Not in release Not in release
linux-flo Not in release Ignored
linux-gcp Not affected Not affected Not affected Fixed Fixed
linux-gcp-4.15 Not in release Not in release Not in release Not affected Not in release
linux-gcp-5.15 Not in release Not in release Not affected Not in release Not in release
linux-gcp-5.4 Not in release Not in release Not in release Not affected Not in release
linux-gcp-6.8 Not in release Not affected Not in release Not in release Not in release
linux-gcp-edge Fixed Not in release
linux-gcp-fips Not in release Not in release Not in release Not in release Ignored
linux-gke Not affected Not affected Ignored Not in release Ignored
linux-gke-4.15 Not in release Not in release Not in release Not affected Not in release
linux-gke-5.0 Not in release Not in release Not in release Not affected Not in release
linux-gkeop Not affected Not affected Not affected Not in release Not in release
linux-gkeop-5.15 Not in release Not in release Not affected Not in release Not in release
linux-goldfish Not in release Ignored
linux-grouper Not in release Not in release
linux-hwe Not in release Not in release Not in release Fixed Fixed
linux-hwe-5.15 Not in release Not in release Not affected Not in release Not in release
linux-hwe-5.4 Not in release Not in release Not in release Not affected Not in release
linux-hwe-6.8 Not in release Not affected Not in release Not in release Not in release
linux-hwe-edge Not in release Not in release Not in release Not affected Fixed
linux-ibm Not affected Not affected Not affected Not in release Not in release
linux-ibm-5.15 Not in release Not in release Not affected Not in release Not in release
linux-ibm-5.4 Not in release Not in release Not in release Not affected Not in release
linux-intel Not affected Not in release Not in release Not in release Not in release
linux-intel-iot-realtime Not in release Not in release Not in release Not in release Not in release
linux-intel-iotg Not in release Not affected Not in release Not in release Not in release
linux-intel-iotg-5.15 Not in release Not in release Not affected Not in release Not in release
linux-iot Not in release Not in release Not affected Not in release Not in release
linux-kvm Not in release Not affected Not affected Fixed Fixed
linux-lowlatency Not affected Not affected Not in release Not in release Not in release
linux-lowlatency-hwe-5.15 Not in release Not in release Not affected Not in release Not in release
linux-lowlatency-hwe-6.8 Not in release Not affected Not in release Not in release Not in release
linux-lts-trusty Not in release Not in release
linux-lts-utopic Not in release Not in release
linux-lts-vivid Not in release Not in release
linux-lts-wily Not in release Not in release
linux-lts-xenial Not in release Not in release Not in release Not in release Not in release
linux-maguro Not in release Not in release
linux-mako Not in release Ignored
linux-manta Not in release Not in release
linux-nvidia Not affected Not affected Not in release Not in release Not in release
linux-nvidia-6.5 Not in release Not affected Not in release Not in release Not in release
linux-nvidia-6.8 Not in release Not affected Not in release Not in release Not in release
linux-nvidia-lowlatency Not affected Not in release Not in release Not in release Not in release
linux-oem Not in release Not in release Not in release Fixed Ignored
linux-oem-6.11 Not affected Not in release Not in release Not in release Not in release
linux-oem-6.8 Not affected Not in release Not in release Not in release Not in release
linux-oracle Not affected Not affected Not affected Fixed Fixed
linux-oracle-5.15 Not in release Not in release Not affected Not in release Not in release
linux-oracle-5.4 Not in release Not in release Not in release Not affected Not in release
linux-oracle-6.8 Not in release Not affected Not in release Not in release Not in release
linux-raspi Not affected Not affected Not affected Not in release Not in release
linux-raspi-5.4 Not in release Not in release Not in release Not affected Not in release
linux-raspi-realtime Not in release Not in release Not in release Not in release Not in release
linux-raspi2 Not in release Not in release Ignored Fixed Fixed
linux-realtime Not in release Ignored Not in release Not in release Not in release
linux-riscv Not affected Ignored Ignored Not in release Not in release
linux-riscv-5.15 Not in release Not in release Not affected Not in release Not in release
linux-riscv-6.8 Not in release Not affected Not in release Not in release Not in release
linux-snapdragon Not in release Not in release Not in release Fixed Fixed
linux-xilinx-zynqmp Not in release Not affected Not affected Not in release Not in release
policykit-1 Fixed Fixed Fixed Fixed Fixed
Show all 81 packages Show less packages

CVE-2018-19788

Medium priority
Fixed

A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command.

1 affected packages

policykit-1

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
policykit-1 Fixed Fixed
Show less packages

CVE-2018-1116

Medium priority
Fixed

A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated...

1 affected packages

policykit-1

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
policykit-1 Fixed Fixed
Show less packages

CVE-2016-2568

Low priority
Vulnerable

pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

1 affected packages

policykit-1

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
policykit-1 Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable
Show less packages

CVE-2015-3256

Low priority
Not affected

PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation."

1 affected packages

policykit-1

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
policykit-1
Show less packages

CVE-2015-4625

Low priority

Some fixes available 13 of 16

Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate...

1 affected packages

policykit-1

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
policykit-1 Fixed Fixed Fixed
Show less packages

CVE-2015-3255

Low priority

Some fixes available 7 of 9

The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions.

1 affected packages

policykit-1

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
policykit-1 Fixed Fixed
Show less packages