17 matches found
CVE-2021-3560-exploit
CVE-2021-3560 — Polkit 权限提升 CVE-2021-3560 是 Polkit （前身为 PolicyKit）中的一个本地权限提升漏洞，Polkit 是 Linux 桌面环境使用的授权框架。本地非特权攻击者可以利用 accounts-daemon D-Bus 接口中的竞态条件创建特权用户、设置其密码，并最终获得 root 访问权限。 工作原理 背景：Polkit + accounts-daemon accounts-daemon（org.freedesktop.Accounts）是一个系统 D-Bus 服务，负责管理用户帐户（创建、删除、密码更改等）。它暴露了以下方...
ptrace_may_dream
ptracemaydream CVE-2026-46333 针对 pidfdgetfd2 中 ptracemayaccess mm=NULL 竞态条件的本地权限提升漏洞利用程序。 当进程正在消亡且其 mm 已被释放时，内核会完全跳过 ptrace 访问检查。通过让 pidfdgetfd 与进程退出进行竞争，非特权用户可以窃取特权进程的打开文件描述符。 该漏洞利用程序针对 accounts-daemon：它通过 SetIconFile 触发一个短生命周期子进程，赢得竞争以获取守护进程的 D-Bus 套接字文件描述符，然后发送 SetShell、SetAccountType 和...
Polkit-CVE-2021-3560
Polkit-CVE-2021-3560 背景 2021年初，一位名叫 Kevin Backhouse 的研究人员发现了 Linux polkit 工具中一个存在七年之久的权限提升漏洞（后被指定为 CVE-2021-3560）。幸运的是，不同的 Linux 发行版（甚至同一发行版的不同版本）使用了不同版本的软件，这意味着只有部分系统存在漏洞。 具体来说，以下主流发行版（以及其他一些发行版）存在漏洞： Red Hat Enterprise Linux 8 Fedora 21（或更高版本） Debian Testing（"Bullseye"） Ubuntu 20.04 LTS（"Focal...
CVE-2026-16743
The CVE-2026-16743 entry concerns accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop done by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to...
EUVD-2026-48570
A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the...
Exploit for Incorrect Authorization in Polkit_Project Polkit
CVE-2021-3560 — Polkit Privilege Escalation CVE-2021-3560 is...
Exploit for Incorrect Authorization in Polkit_Project Polkit
CVE-2021-3560 — Polkit Privilege Escalation CVE-2021-3560 is...
CVE-2023-3297
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process...
AZL-43453 CVE-2023-3297 affecting package accountsservice 0.6.55-4
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process...
Double free
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process...
CVE-2023-3297
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process...
CVE-2023-3297
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process...
SUSE CVE-2023-3297
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process...
CVE-2023-3297
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process...
UBUNTU-CVE-2023-3297
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process...
Denial Of Service (DoS)
gdm3 is vulnerable to denial of service DoS. The vulnerability is in gdm3 LPE due to unresponsive accounts-daemon.this could allow a local user to create a new privileged account...