A flaw was found in polkit.
A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.
What happened
A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.
Does it affect you
Not enough information
No products recorded, so this cannot be matched against anything.
What to do
- Follow the vendor advisory for the fixed release and any interim mitigation.
access.redhat.com - Apply the vendor patch named in this advisory.
github.com - Apply the vendor patch named in this advisory.
github.com
Vendor's affected list
- rhel
- Exactly 6.0
Sources
A verdict here is derived from what you told us and what the vendor published. It is not an assessment of your environment. Why we never say you are safe.