- pkexec is installed by default on all major Linux distributions (we
exploited Ubuntu, Debian, Fedora, CentOS, and other distributions are
probably also exploitable);
- pkexec is vulnerable since its creation, in May 2009 (commit c8c3d83,
"Add a pkexec(1) command");
- any unprivileged local user can exploit this vulnerability to obtain
full root privileges;
- although this vulnerability is technically a memory corruption, it is
exploitable instantly, reliably, in an architecture-independent way;
- and it is exploitable even if the polkit daemon itself is not running.
[...]
More precisely:
- if our PATH environment variable is "PATH=name", and if the directory
"name" exists (in the current working directory) and contains an
executable file named "value", then a pointer to the string
"name/value" is written out-of-bounds to envp[0];
- or, if our PATH is "PATH=name=.", and if the directory "name=." exists
and contains an executable file named "value", then a pointer to the
string "name=./value" is written out-of-bounds to envp[0].