In systemd before v242-rc4 it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker in some particular configurations to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".

🗓️ 18 Aug 2020 07:00:00Reported by MicrosoftType

Systemd before v242-rc4 failed to sanitize XDG_SEAT, enabling attackers to affect polkit.

Reporter	Title	Published	Views	Family All 99
zdt	systemd - Lack of Seat Verification in PAM Module Permits Spoofing Active Session to polkit Exploit	23 Apr 201900:00	–	zdt
ALT Linux	Security fix for the ALT Linux 9 package systemd version 1:242-alt1	13 Apr 201900:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
IBM Security Bulletins	Security Bulletin: Vyatta 5600 vRouter Software Patches - Releases 1801-w and 1801-y	1 May 201917:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	3 Dec 202118:52	–	ibm
Tenable Nessus	Amazon Linux 2 : systemd (ALAS-2022-1854)	10 Oct 202200:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0039: systemd (ALINUX3-SA-2022:0039)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : systemd (ALSA-2021:1611)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : systemd (CESA-2021:1611)	19 May 202100:00	–	nessus
Tenable Nessus	Debian DSA-4428-1 : systemd - security update	9 Apr 201900:00	–	nessus