Table of Contents
Researchers at GitHub Security Lab have discovered a flaw in Linux that has the ability to be exploited to grant root-level access to targeted systems.
This vulnerability was revealed by Kevin Backhouse, a researcher at GitHub. Polkit, a system service commonly found on Linux distributions, is vulnerable to the highly critical security vulnerability designated as CVE-2021-3560.
An explanation of Kevin’s findings and an explanation of the exploit in polkit were published Thursday on his blog.
With just a few commands in the terminal, an unprivileged attacker can escalate privileges to root.
CVE-2021-3560 is an exploitable vulnerability that impacts versions of Linux, Fedora, Debian, and Ubuntu dubbed Red Hat Enterprise Linux, Fedora, and Debian. Earlier this month, a patch was released to address CVE-2021-3560.
“The bug I found was quite old. It was introduced seven years ago in commit bfa5036 and first shipped with polkit version 0.113. However, many of the most popular Linux distributions didn’t ship the vulnerable version until more recently.
The bug has a slightly different history on Debian and its derivatives (such as Ubuntu) because Debian uses a fork of polkit with a different version numbering scheme.
In the Debian fork, the bug was introduced in commit f81d021 and first shipped with version 0.105-26. The most recent stable release of Debian, Debian 10 (“buster”), uses version 0.105-25, which means that it isn’t vulnerable.”
Vulnerable to Intermediate Hackers
It allows non-privileged processes to communicate easily with privileged processes through the control of system privileges.
As described by Backhouse, it functions as a judge, determining whether a user’s action can be performed directly or if there is a need for more authorization, for example, by entering a password.
It is easy to exploit the vulnerability identified by the researcher with just a few commands in the terminal. The exploit usually takes a few attempts to be successful due to some timing requirements.
Unprivileged local hackers may be able to gain root privileges via CVE-2021-3560. Therefore, users must update their installations as quickly as possible because it is very simple and quick to exploit.
Systems running version 0.113 (or greater) of polkit are vulnerable. Among those are popular distributions like RHEL 8 and Ubuntu 20.04.