Описание
pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
It was found that pkexec was vulnerable to TIOCSTI ioctl attacks, allowing the executed program to push characters to its TTY's input buffer. While being executed as a non-privileged user, a specially crafted program could force its parent TTY to enter commands, interpreted by the shell when pkexec exits.
Отчет
This issue affects the versions of polkit as shipped with Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. This vulnerability requires user interaction for successful exploitation, which is why this vulnerability has been marked as moderate by Red Hat. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | polkit | Will not fix | ||
| Red Hat Enterprise Linux 7 | polkit | Will not fix | ||
| Red Hat Enterprise Linux 9 | polkit | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6.1 Medium
CVSS3
5.1 Medium
CVSS2
Связанные уязвимости
pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
pkexec, when used with --user nonpriv, allows local users to escape to the parent session
pkexec, when used with --user nonpriv, allows local users to escape to ...
pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
EPSS
6.1 Medium
CVSS3
5.1 Medium
CVSS2