CVE-2021-3560

Name of the Vulnerable Software and Affected Versions Polkit versions prior to 0.119

Description It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this issue is to data confidentiality and integrity as well as system availability. The polkit system bus name get creds sync() function of the dbus-daemon library is associated with insufficient access control, allowing an attacker to elevate their privileges.

Recommendations Polkit version prior to 0.119: Update to Polkit version 0.119 or later to resolve the issue.