• Colin Walters's avatar
    CVE-2015-4625: Bind use of cookies to specific uids · 493aa5dc
    Colin Walters authored
    http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html
    
    The "cookie" value that Polkit hands out is global to all polkit
    users.  And when `AuthenticationAgentResponse` is invoked, we
    previously only received the cookie and *target* identity, and
    attempted to find an agent from that.
    
    The problem is that the current cookie is just an integer
    counter, and if it overflowed, it would be possible for
    an successful authorization in one session to trigger a response
    in another session.
    
    The overflow and ability to guess the cookie were fixed by the
    previous patch.
    
    This patch is conceptually further hardening on top of that.  Polkit
    currently treats uids as equivalent from a security domain
    perspective; there is no support for
    SELinux/AppArmor/etc. differentiation.
    
    We can retrieve the uid from `getuid()` in the setuid helper, which
    allows us to ensure the uid invoking `AuthenticationAgentResponse2`
    matches that of the agent.
    
    Then the authority only looks at authentication sessions matching the
    cookie that were created by a matching uid, thus removing the ability
    for different uids to interfere with each other entirely.
    
    Several fixes to this patch were contributed by:
    Miloslav Trmač <mitr@redhat.com>
    
    Bug: https://bugs.freedesktop.org/show_bug.cgi?id=90837
    CVE: CVE-2015-4625
    Reported-by: 's avatarTavis Ormandy <taviso@google.com>
    Reviewed-by: 's avatarMiloslav Trmač <mitr@redhat.com>
    Signed-off-by: Colin Walters's avatarColin Walters <walters@redhat.com>
    493aa5dc
Name
Last commit
Last update
..
Makefile.am Loading commit data...
polkit.h Loading commit data...
polkitactiondescription.c Loading commit data...
polkitactiondescription.h Loading commit data...
polkitauthority.c Loading commit data...
polkitauthority.h Loading commit data...
polkitauthorityfeatures.c Loading commit data...
polkitauthorityfeatures.h Loading commit data...
polkitauthorizationresult.c Loading commit data...
polkitauthorizationresult.h Loading commit data...
polkitcheckauthorizationflags.c Loading commit data...
polkitcheckauthorizationflags.h Loading commit data...
polkitdetails.c Loading commit data...
polkitdetails.h Loading commit data...
polkitenumtypes.c.template Loading commit data...
polkitenumtypes.h.template Loading commit data...
polkiterror.c Loading commit data...
polkiterror.h Loading commit data...
polkitidentity.c Loading commit data...
polkitidentity.h Loading commit data...
polkitimplicitauthorization.c Loading commit data...
polkitimplicitauthorization.h Loading commit data...
polkitpermission.c Loading commit data...
polkitpermission.h Loading commit data...
polkitprivate.h Loading commit data...
polkitsubject.c Loading commit data...
polkitsubject.h Loading commit data...
polkitsystembusname.c Loading commit data...
polkitsystembusname.h Loading commit data...
polkittemporaryauthorization.c Loading commit data...
polkittemporaryauthorization.h Loading commit data...
polkittypes.h Loading commit data...
polkitunixgroup.c Loading commit data...
polkitunixgroup.h Loading commit data...
polkitunixnetgroup.c Loading commit data...
polkitunixnetgroup.h Loading commit data...
polkitunixprocess.c Loading commit data...
polkitunixprocess.h Loading commit data...
polkitunixsession-systemd.c Loading commit data...
polkitunixsession.c Loading commit data...
polkitunixsession.h Loading commit data...
polkitunixuser.c Loading commit data...
polkitunixuser.h Loading commit data...