Devuan bug report logs - #658
policykit-1: CVE-2021-4034

Full log

🔗 View this message in rfc822 format

MIME-Version: 1.0
X-Mailer: MIME-tools 5.509 (Entity 5.509)
X-Loop: owner@bugs.devuan.org
From: "Devuan bug Tracking System" <owner@bugs.devuan.org>
To: Dimitris <dimitris@stinpriza.org>
Subject: bug#658 closed by Mark Hindley <mark@hindley.org.uk> (Re:
 bug#658: policykit-1: CVE-2021-4034)
Message-ID: <handler.658.D658.164320254313938.notifdone@bugs.devuan.org>
References: <YfFHoBAYS5u30+hO@hindley.org.uk>
 <40c391db-619c-579c-c077-3360f12400d3@stinpriza.org>
X-Devuan-PR-Message: they-closed 658
X-Devuan-PR-Package: policykit-1
Reply-To: 658@bugs.devuan.org
Date: Wed, 26 Jan 2022 13:10:04 +0000
Content-Type: multipart/mixed; boundary="----------=_1643202604-13971-1"

[Message part 1 (text/plain, inline)]

This is an automatic notification regarding your bug report
which was filed against the policykit-1 package:

#658: policykit-1: CVE-2021-4034

It has been closed by Mark Hindley <mark@hindley.org.uk>.

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact Mark Hindley <mark@hindley.org.uk> by
replying to this email.


-- 
658: https://bugs.devuan.org/cgi/bugreport.cgi?bug=658
Devuan Bug Tracking System
Contact owner@bugs.devuan.org with problems

[Message part 2 (message/rfc822, inline)]

From: Mark Hindley <mark@hindley.org.uk>

To: Dimitris <dimitris@stinpriza.org>, 658-done@bugs.devuan.org

Subject: Re: bug#658: policykit-1: CVE-2021-4034

Date: Wed, 26 Jan 2022 13:07:44 +0000

Version: 0.105-31.1+devuan1

Dimitris,

On Wed, Jan 26, 2022 at 12:24:28PM +0200, Dimitris wrote:
> Package: policykit-1
> Version: 0.105-31+devuan1
> Severity: critical
> Tags: security
> Justification: root security hole
> X-Debbugs-Cc: dimitris@stinpriza.org

Updated binaries are already in unstable, daedalus, chimaera-security and
beowulf-security. Ascii-security is building.

Mark

[Message part 3 (message/rfc822, inline)]

From: Dimitris <dimitris@stinpriza.org>

To: Devuan Bug Tracking System <submit@bugs.devuan.org>

Subject: policykit-1: CVE-2021-4034

Date: Wed, 26 Jan 2022 12:24:28 +0200

Package: policykit-1
Version: 0.105-31+devuan1
Severity: critical
Tags: security
Justification: root security hole
X-Debbugs-Cc: dimitris@stinpriza.org

hey,

just a heads up on a very recent vulnerability found in polkit. a Local 
Privilege Escalation in polkit's pkexec (CVE-2021-4034). fixed in some 
versions in debian, probably devuan needs to address this too.

links :
https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
https://security-tracker.debian.org/tracker/CVE-2021-4034

thanks in advance,
d.


-- System Information:
Distributor ID:	Devuan
Description:	Devuan GNU/Linux 5 (daedalus/ceres)
Release:	5
Codename:	daedalus ceres
Architecture: x86_64

Kernel: Linux 5.16.2-xanmod1 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_FIRMWARE_WORKAROUND
Locale: LANG=el_GR.UTF-8, LC_CTYPE=el_GR.UTF-8 (charmap=UTF-8), LANGUAGE 
not set
Shell: /bin/sh linked to /bin/dash
Init: runit (via /run/runit.stopit)
LSM: AppArmor: enabled

Versions of packages policykit-1 depends on:
ii  dbus                                                   1.12.20-3+devuan3
ii  libc6                                                  2.33-4
ii  libelogind0                                            246.10-3
ii  libexpat1                                              2.4.3-2
ii  libglib2.0-0                                           2.70.2-1
ii  libpam-elogind [logind]                                246.10-3
ii  libpam0g                                               1.4.0-11
ii  libpolkit-agent-1-0                                    0.105-31+devuan1
ii  libpolkit-gobject-1-0                                  0.105-31+devuan1
ii  libpolkit-gobject-elogind-1-0 [libpolkit-gobject-1-0]  0.105-31+devuan1

Versions of packages policykit-1 recommends:
ii  lxpolkit [polkit-1-auth-agent]           0.5.5-2+b1
ii  policykit-1-gnome [polkit-1-auth-agent]  0.105-7+b1

policykit-1 suggests no packages.

Versions of packages policykit-1 is related to:
ii  elogind                          246.10-3
ii  libpam-elogind [libpam-systemd]  246.10-3
pn  systemd                          <none>

-- no debconf information

Send a report that this bug log contains spam.