Zbus Polkit
Monthly
Privilege escalation in zbus_polkit before 5.1.0 stems from Subject::new_for_owner() encoding the UID as D-Bus type u (unsigned 32-bit) rather than the type i (signed 32-bit) mandated by org.freedesktop.PolicyKit1.Authority, silently nullifying any caller-supplied UID and causing polkit to fall back to a TOCTOU-vulnerable /proc PID lookup. Applications that pass SO_PEERCRED-derived UIDs specifically to defend against PID reuse receive no benefit, as the value is discarded before polkit processes the authorization subject. A local low-privileged attacker who causes an authorized process to exit and wins the PID reassignment race is granted that process's polkit authorization; no public exploit code has been identified at time of analysis.
Privilege escalation in zbus_polkit before 5.1.0 stems from Subject::new_for_owner() encoding the UID as D-Bus type u (unsigned 32-bit) rather than the type i (signed 32-bit) mandated by org.freedesktop.PolicyKit1.Authority, silently nullifying any caller-supplied UID and causing polkit to fall back to a TOCTOU-vulnerable /proc PID lookup. Applications that pass SO_PEERCRED-derived UIDs specifically to defend against PID reuse receive no benefit, as the value is discarded before polkit processes the authorization subject. A local low-privileged attacker who causes an authorized process to exit and wins the PID reassignment race is granted that process's polkit authorization; no public exploit code has been identified at time of analysis.