Lucene search

RedhatCVE-2021-3560

HistoryFeb 16, 2022 - 7:15 p.m.

CVE-2021-3560

2022-02-1619:15:08

CWE-863

CWE-754

redhat

web.nvd.nist.gov

702

In Wild

polkit

cve-2021-3560

vulnerability

local attacker

privilege escalation

bypass

credential checks

data integrity

system availability

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.1

Confidence

Low

EPSS

0.012

Percentile

85.1%

JSON

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected configurations

Nvd

Vulners

Node

polkit_projectpolkitRange<0.119

Node

debiandebian_linuxMatch11.0

Node

canonicalubuntu_linuxMatch20.04

Node

redhatvirtualizationMatch4.0

redhatvirtualization_hostMatch4.0

AND

redhatenterprise_linuxMatch8.0

Node

redhatopenshift_container_platformMatch4.7

AND

redhatenterprise_linuxMatch7.0

redhatenterprise_linuxMatch8.0

VendorProductVersionCPE
polkit_projectpolkit*cpe:2.3:a:polkit_project:polkit:*:*:*:*:*:*:*:*
debiandebian_linux11.0cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
canonicalubuntu_linux20.04cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:*:*:*:*
redhatvirtualization4.0cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
redhatvirtualization_host4.0cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
redhatenterprise_linux8.0cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
redhatopenshift_container_platform4.7cpe:2.3:a:redhat:openshift_container_platform:4.7:*:*:*:*:*:*:*
redhatenterprise_linux7.0cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
polkit_project	polkit	*	cpe:2.3:a:polkit_project:polkit::::::::
debian	debian_linux	11.0	cpe:2.3:o:debian:debian_linux:11.0:::::::*
canonical	ubuntu_linux	20.04	cpe:2.3:o:canonical:ubuntu_linux:20.04:::::::*
redhat	virtualization	4.0	cpe:2.3:a:redhat:virtualization:4.0:::::::*
redhat	virtualization_host	4.0	cpe:2.3:a:redhat:virtualization_host:4.0:::::::*
redhat	enterprise_linux	8.0	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
redhat	openshift_container_platform	4.7	cpe:2.3:a:redhat:openshift_container_platform:4.7:::::::*
redhat	enterprise_linux	7.0	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "polkit",
    "versions": [
      {
        "version": "polkit 0.119",
        "status": "affected"
      }
    ]
  }
]