p PatchFirst

CVE-2021-3560

CVE-2021-3560

This page contains facts from public vulnerability sources. Check the original advisory before updating.

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 7.8 · High · EPSS 23.7% · In KEV · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • polkit

    Versions
    • polkit 0.119: Affected

    No fix published

  • policykit-1 Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.105-31

    Update to 0.105-31

  • policykit-1 Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.105-31

    Update to 0.105-31

  • policykit-1 Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.105-31

    Update to 0.105-31

  • policykit-1 Ubuntu:20.04:LTS

    Versions
    • 0.105-26ubuntu1
    Affected ranges
    • ECOSYSTEM: < 0.105-26ubuntu1.1

    Update to 0.105-26ubuntu1.1

  • policykit-1 Ubuntu:22.04:LTS

    Affected ranges
    • ECOSYSTEM: < 0.105-31

    Update to 0.105-31

Original sources

Check your server →