Critical Security Update for polkit: Addressing CVE-2021-4115 Vulnerability
Summary
RHSA-2022:1546: Red Hat Security Advisory: polkit security update. Affects polkit versions < 0:0.115-13.el8_5.2. Fixed in 0:0.115-13.el8_5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Polkit is a toolkit for defining and handling authorizations in Linux-based systems. It allows unprivileged processes to communicate with privileged ones, providing a way to manage system permissions. The polkit package is essential for controlling access to system services and resources, making it a critical component in maintaining system security and integrity. However, it has been identified as vulnerable to a security issue that could potentially allow unauthorized access to system resources.
Vulnerability Detail
The vulnerability identified as CVE-2021-4115 affects polkit, allowing an attacker to escalate privileges by exploiting a flaw in the authorization mechanism. This could lead to unauthorized actions being performed on the system, compromising its security. The vulnerability arises from improper handling of user permissions, which could be exploited by local users to gain elevated privileges. The potential ramifications include unauthorized access to sensitive data and the ability to execute arbitrary commands with elevated privileges.
How To Fix
Minimum fixed version
0:0.115-13.el8_5.2
This is the first release that contains the fix.
sudo dnf update polkitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators can restrict access to polkit services or limit user permissions until the package is updated. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The CVE-2021-4115 vulnerability in the polkit package poses a significant security risk, allowing local users to escalate privileges. It is crucial to update to the patched version 0:0.115-13.el8_5.2 to mitigate this risk. Regular monitoring and vulnerability management, such as using tools like Vulert, can help maintain system security.
See every vulnerability recorded for polkit →
FAQ
CVE-2021-4115 is a security vulnerability in the polkit package that allows local users to escalate privileges and perform unauthorized actions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include unauthorized access to sensitive data and the ability to execute commands with elevated privileges, which could compromise system security.
Yes, a patch is available in version 0:0.115-13.el8_5.2 of the polkit package. Updating to this version will fix the vulnerability.
If immediate updating is not possible, consider restricting access to polkit services or limiting user permissions as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for polkit.
