Vulnerability Name:

CVE-2021-3560 (CCN-202979)

Assigned:2021-06-03
Published:2021-06-03
Updated:2023-06-12
Summary:Polkit could allow a local attacker to gain elevated privileges on the system, caused by a flaw in the polkit_system_bus_name_get_creds_sync function. By sending a specially-crafted request, an attacker could exploit this vulnerability to gain root privileges.
CVSS v3 Severity:7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.2 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.8 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.2 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2021-3560

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: Issue Tracking, Patch, Vendor Advisory
secalert@redhat.com

Source: XF
Type: UNKNOWN
polkit-cve20213560-priv-esc(202979)

Source: secalert@redhat.com
Type: Exploit, Third Party Advisory
secalert@redhat.com

Source: CCN
Type: polkit GitLab
GHSL-2021-074: authentication bypass vulnerability in polkit

Source: CCN
Type: Packet Storm Security [06-15-2021]
Polkit 0.105-26 0.117-2 Privilege Escalation

Source: CCN
Type: Packet Storm Security [07-09-2021]
Polkit D-Bus Authentication Bypass

Source: CCN
Type: Packet Storm Security [11-29-2021]
Polkit Authentication Bypass / Local Privilege Escalation

Source: CCN
Type: Packet Storm Security [12-10-2021]
Polkit CVE-2021-3560 Research

Source: CCN
Type: oss-sec Mailing List, Thu, 3 Jun 2021 16:09:38 +0200
CVE-2021-3560 polkit: local privilege escalation using polkit_system_bus_name_get_creds_sync()

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [06-15-2021]

Source: CCN
Type: Rapid7 Vulnerability and Exploit Database [06-03-2021]
Polkit D-Bus Authentication Bypass

Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*
    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:polkit_project:polkit:0.113:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7646
    P
    		libpolkit-agent-1-0-121-150500.1.6 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:51570
    P
    		Security update for libdb-4_8 (Low)
    2022-11-24
    oval:org.opensuse.security:def:713
    P
    		Security update for libyang (Important)
    2022-08-26
    oval:org.opensuse.security:def:95265
    P
    		Security update for python-PyJWT (Important)
    2022-07-14
    oval:org.opensuse.security:def:3428
    P
    		apache-commons-daemon-1.0.15-6.10 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3059
    P
    		e2fsprogs-1.43.8-3.8.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3614
    P
    		libjbig2-2.0-12.13 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94689
    P
    		libpolkit0-0.116-3.9.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94540
    P
    		dracut-055+suse.252.g4988b0bf-150400.1.8 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:101978
    P
    		Security update for the Linux Kernel (Live Patch 2 for SLE 15 SP3) (Important)
    2022-04-25
    oval:org.opensuse.security:def:99465
    P
    		 (Important)
    2022-03-30
    oval:org.opensuse.security:def:6035
    P
    		Security update for java-1_7_1-ibm (Moderate)
    2022-01-24
    oval:org.opensuse.security:def:112778
    P
    		libpolkit0-0.118-7.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106249
    P
    		Security update for binutils (Moderate)
    2021-11-04
    oval:org.opensuse.security:def:97023
    P
    		libwsman-devel-2.6.7-3.3.1 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:97024
    P
    		libxmltooling-devel-1.6.4-3.3.2 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:101253
    P
    		bsh2-2.0.0.b6-10.65 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:99972
    P
    		 (Important)
    2021-07-14
    oval:org.opensuse.security:def:111563
    P
    		Security update for polkit (Important)
    2021-07-11
    oval:org.opensuse.security:def:111421
    P
    		Security update for polkit (Important)
    2021-06-04
    oval:org.opensuse.security:def:34451
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:64703
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:99074
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:30203
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:57925
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:86566
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:125544
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:107919
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:82580
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:93742
    P
    		 (Important)
    2021-06-03
    oval:com.redhat.rhsa:def:20212238
    P
    		RHSA-2021:2238: polkit security update (Important)
    2021-06-03
    oval:org.opensuse.security:def:9715
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:92515
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:101444
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:5717
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:69656
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:32934
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:60274
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:89138
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:26065
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:56026
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:84609
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:73825
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:93219
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:93251
    P
    		 (Important)
    2021-06-03
    oval:org.opensuse.security:def:8963
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:91929
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:99953
    P
    		 (Important)
    2021-06-03
    oval:org.opensuse.security:def:35252
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:66806
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:99266
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:31183
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:58757
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:87398
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:126714
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:108644
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:51899
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:83290
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:93957
    P
    		 (Important)
    2021-06-03
    oval:org.opensuse.security:def:10087
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:92714
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:69855
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:33660
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:61075
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:89396
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:29373
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:57006
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:85647
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:5052
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:75874
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:93408
    P
    		 (Important)
    2021-06-03
    oval:org.opensuse.security:def:9333
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:92124
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:100288
    P
    		 (Important)
    2021-06-03
    oval:org.opensuse.security:def:67124
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:31630
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:59483
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:88128
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:127111
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:23582
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:55196
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:83410
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:94168
    P
    		 (Important)
    2021-06-03
    oval:org.opensuse.security:def:10266
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:92913
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:8588
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:70227
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:33918
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:64517
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:98879
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:30083
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:57453
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:86094
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:117434
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:76192
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:93565
    P
    		 (Important)
    2021-06-03
    oval:org.opensuse.security:def:9516
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:92316
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:100617
    P
    		 (Important)
    2021-06-03
    oval:org.opensuse.security:def:69473
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:99664
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:32102
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:59741
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:88441
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:23911
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:55906
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:84151
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:94380
    P
    		 (Important)
    2021-06-03
    oval:org.opensuse.security:def:73639
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:93066
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:42081
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:8768
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:70406
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:99641
    P
    		 (Important)
    2021-06-03
    BACK
    polkit_project polkit 0.113