Nixpkgs security tracker
5.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
Polkit: polkit: denial of service via unbounded input processing through standard input
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
References
Affected products
Matching in nixpkgs
pkgs.polkit
Toolkit for defining and handling the policy that allows unprivileged processes to speak to privileged processes
pkgs.cmd-polkit
Easily create polkit authentication agents by using commands
pkgs.mate-polkit
Integrates polkit authentication for MATE desktop
pkgs.polkit_gnome
Dbus session bus service that is used to bring up authentication dialogs
pkgs.hyprpolkitagent
Polkit authentication agent written in QT/QML
pkgs.mate.mate-polkit
Integrates polkit authentication for MATE desktop
pkgs.pcscliteWithPolkit
Middleware to access a smart card using SCard API (PC/SC)
pkgs.polkit-stdin-agent
Non-interactive polkit authentication agent that answers PAM prompts from a file descriptor
pkgs.libsForQt5.polkit-qt
Qt wrapper around PolKit
pkgs.kdePackages.polkit-qt-1
Qt wrapper around Polkit-1 client libraries
pkgs.lomiri.lomiri-polkit-agent
Policy kit agent for the Lomiri desktop
pkgs.kdePackages.polkit-kde-agent-1
Daemon providing a Polkit authentication UI for Plasma
pkgs.pantheon.pantheon-agent-polkit
Polkit Agent for the Pantheon Desktop
Package maintainers
-
@Daru-san Daru <zadarumaka@proton.me>
-
@NotAShelf NotAShelf <raf@notashelf.dev>
-
@khaneliman Austin Horstman <khaneliman12@gmail.com>
-
@johnrtitor Masum Reza <masumrezarock100@gmail.com>
-
@fufexan Fufezan Mihai <fufexan@protonmail.com>
-
@donovanglover Donovan Glover
-
@bkchr Bastian Köcher <nixos@kchr.de>
-
@peterhoeg Peter Hoeg <peter@hoeg.com>
-
@K900 Ilya K. <me@0upti.me>
-
@ilya-fedin Ilya Fedin <fedin-ilja2010@ya.ru>
-
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
-
@LunNova Luna Nova <nixpkgs-maintainer@lunnova.dev>
-
@FRidh Frederik Rietdijk <fridh@fridh.nl>
-
@mjm Matt Moriarity <matt@mattmoriarity.com>
-
@nyanloutre Paul Trehiou <paul@nyanlout.re>
-
@NickCao Nick Cao <nickcao@nichi.co>
-
@OPNA2608 Cosima Neidahl <opna2608@protonmail.com>
-
@romildo José Romildo Malaquias <malaquias@gmail.com>
-
@bobby285271 Bobby Rong <rjl931189261@126.com>
-
@amz-x Christopher Crouse <mail@amz-x.com>
-
@davidak David Kleuker <post@davidak.de>
-
@anthonyroussel Anthony Roussel <anthony@roussel.dev>
-
@jtojnar Jan Tojnar <jtojnar@gmail.com>
-
@Hythera Hythera
-
@R-VdP Ramses <ramses@well-founded.dev>