pool/polkit
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()

Browse Source 
(bsc#1186497)
  CVE-2021-3560.patch

OBS-URL: https://build.opensuse.org/package/show/Base:System/polkit?expand=0&rev=156
This commit is contained in:
Marcus Meissner 2021-06-11 09:24:05 +00:00 committed by Git OBS Bridge
parent a04790d11c
commit 1df0a7ac75
3 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
CVE-2021-3560.patch Normal file
View File

@ -0,0 +1,13 @@
--- a/src/polkit/polkitsystembusname.c
+++ b/src/polkit/polkitsystembusname.c
@@ -435,6 +435,9 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName *system_bus
while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error))
g_main_context_iteration (tmp_context, TRUE);
+ if (data.caught_error)
+ goto out;
+
if (out_uid)
*out_uid = data.uid;
if (out_pid)

7
polkit.changes
View File

@ -4,6 +4,13 @@ Wed Jun 9 07:09:16 UTC 2021 - Dominique Leuenberger <dimstar@opensuse.org>
- Fix verifyscript: the path to the binary was wrongly defined as
%{_libexecdir}/lib.
-------------------------------------------------------------------
Thu May 27 11:52:44 UTC 2021 - Marcus Meissner <meissner@suse.com>
- CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync()
(bsc#1186497)
CVE-2021-3560.patch
-------------------------------------------------------------------
Thu Mar 11 22:21:07 UTC 2021 - Thorsten Kukuk <kukuk@suse.com>

2
polkit.spec
View File

@ -39,6 +39,8 @@ Patch3: polkit-keyinit.patch
# adjust path to polkit-agent-helper-1 (bsc#1180474)
Patch4: polkit-adjust-libexec-path.patch
Patch5: CVE-2021-3560.patch
BuildRequires: gcc-c++
BuildRequires: gtk-doc
BuildRequires: intltool