CVE-2021-4115

Publication date 14 February 2022

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
policykit-1	22.04 LTS jammy	Not affected
	21.10 impish	Fixed 0.105-31ubuntu0.2
	20.04 LTS focal	Fixed 0.105-26ubuntu1.3
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected

Notes

mdeslaur

Introduced by backported patch in focal+: PolkitSystemBusName-Retrieve-both-pid-and-uid.patch

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
policykit-1	Upstream: 41cb093

Severity score breakdown

Parameter	Value
Base score	5.5 · Medium
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

USN-5304-1
PolicyKit vulnerability
28 February 2022