Nixpkgs security tracker
5.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
Polkit: polkit: denial of service via unbounded input processing through standard input
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
References
Affected products
Matching in nixpkgs
pkgs.polkit
Toolkit for defining and handling the policy that allows unprivileged processes to speak to privileged processes
pkgs.cmd-polkit
Easily create polkit authentication agents by using commands
pkgs.mate-polkit
Integrates polkit authentication for MATE desktop
pkgs.polkit_gnome
Dbus session bus service that is used to bring up authentication dialogs
pkgs.hyprpolkitagent
Polkit authentication agent written in QT/QML
pkgs.mate.mate-polkit
Integrates polkit authentication for MATE desktop
pkgs.pcscliteWithPolkit
Middleware to access a smart card using SCard API (PC/SC)
pkgs.polkit-stdin-agent
Non-interactive polkit authentication agent that answers PAM prompts from a file descriptor
pkgs.libsForQt5.polkit-qt
Qt wrapper around PolKit
pkgs.kdePackages.polkit-qt-1
Qt wrapper around Polkit-1 client libraries
pkgs.lomiri.lomiri-polkit-agent
Policy kit agent for the Lomiri desktop
pkgs.kdePackages.polkit-kde-agent-1
Daemon providing a Polkit authentication UI for Plasma
pkgs.pantheon.pantheon-agent-polkit
Polkit Agent for the Pantheon Desktop
Package maintainers
-
@Daru-san Daru <zadarumaka@proton.me>
-
@khaneliman Austin Horstman <khaneliman12@gmail.com>
-
@donovanglover Donovan Glover
-
@NotAShelf NotAShelf <raf@notashelf.dev>
-
@fufexan Fufezan Mihai <fufexan@protonmail.com>
-
@johnrtitor Masum Reza <masumrezarock100@gmail.com>
-
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
-
@ilya-fedin Ilya Fedin <fedin-ilja2010@ya.ru>
-
@mjm Matt Moriarity <matt@mattmoriarity.com>
-
@FRidh Frederik Rietdijk <fridh@fridh.nl>
-
@bkchr Bastian Köcher <nixos@kchr.de>
-
@peterhoeg Peter Hoeg <peter@hoeg.com>
-
@nyanloutre Paul Trehiou <paul@nyanlout.re>
-
@LunNova Luna Nova <nixpkgs-maintainer@lunnova.dev>
-
@K900 Ilya K. <me@0upti.me>
-
@NickCao Nick Cao <nickcao@nichi.co>
-
@OPNA2608 Cosima Neidahl <opna2608@protonmail.com>
-
@romildo José Romildo Malaquias <malaquias@gmail.com>
-
@bobby285271 Bobby Rong <rjl931189261@126.com>
-
@amz-x Christopher Crouse <mail@amz-x.com>
-
@davidak David Kleuker <post@davidak.de>
-
@anthonyroussel Anthony Roussel <anthony@roussel.dev>
-
@Hythera Hythera
-
@jtojnar Jan Tojnar <jtojnar@gmail.com>
-
@R-VdP Ramses <ramses@well-founded.dev>