CVE-2018-1116
Fixed in a distro release EPSS 1%CVSS 4.7
A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.
Products: debian_linux, canonical ubuntu_linux, polkit_project polkit
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | polkit | 0.112-26.amzn2 |
| Amazon Linux 2 | polkit-devel | 0.112-26.amzn2 |
| Amazon Linux 2 | polkit-docs | 0.112-26.amzn2 |
| Debian 12 | policykit-1 | 0.105-21 |
| Debian 13 | policykit-1 | 0.105-21 |
| Debian 14 | policykit-1 | 0.105-21 |
| Debian 8 | policykit-1 | 0.105-15~deb8u3 |
| Red Hat Enterprise Linux 7 | polkit | 0:0.112-26.el7 |
| Red Hat Enterprise Linux 7 | polkit-debuginfo | 0:0.112-26.el7 |
| Red Hat Enterprise Linux 7 | polkit-devel | 0:0.112-26.el7 |
| Red Hat Enterprise Linux 7 | polkit-docs | 0:0.112-26.el7 |
| SUSE Linux Enterprise Desktop 12 SP3 | polkit | 0.113-5.9.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | polkit | 0.114-3.3.1 |
| SUSE Linux Enterprise Server 12 SP3 | polkit | 0.113-5.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | polkit | 0.113-5.9.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | polkit | 0.113-5.9.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP3 | polkit | 0.113-5.9.1 |
| Ubuntu 14.04 LTS | policykit-1 | 0.105-4ubuntu3.14.04.2 |
| Ubuntu 16.04 LTS | policykit-1 | 0.105-14.1ubuntu0.1 |
| Ubuntu 18.04 LTS | policykit-1 | 0.105-20ubuntu0.18.04.1 |
| openSUSE Tumbleweed | polkit | 0.118-7.2 |