Pwnkit: Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)

Re:Pwnkit: Local Privilege Escalation in polkit's pkexec (CV... by aftbit on Tuesday January 25, 2022 @05:46PM (#30079204)

I get:

    [~] compile helper..
    [~] maybe get shell now?
    The value for environment variable XAUTHORITY contains suscipious content
    
    This incident has been reported.

And no root shell

[ Parent | on HN ]

Re:Pwnkit: Local Privilege Escalation in polkit's pkexec (CV... by Pieman103021 on Tuesday January 25, 2022 @09:11PM (#30080802)

Adding `GIO_USE_VFS=` to the end of `a_envp` (starting on line 56), fixes that for me on Fedora 34 with polkit-0.117-3. If anybody knows why that makes a difference, I would love to hear.

[ Parent | on HN ]

Re:Pwnkit: Local Privilege Escalation in polkit's pkexec (CV... by vrzh on Saturday January 29, 2022 @11:55AM (#30127894)

Ran into this while writing my exploit. I explain it here https://github.com/v-rzh/CVE-2021-4034/blob/master/README.md... :)

[ Parent | on HN ]

Re:Pwnkit: Local Privilege Escalation in polkit's pkexec (CV... by hakube on Tuesday January 25, 2022 @10:45PM (#30081425)

I've just updated my Arch system and tried this. No longer works

[ Parent | on HN ]

Re:Pwnkit: Local Privilege Escalation in polkit's pkexec (CV... by makeworld on Tuesday January 25, 2022 @10:50PM (#30081450)

Same. Seems like the exploit wouldn't work for me. When I modify the XAUTHORITY line in the code, either to remove it or point it to my current XAUTHORITY value, I rightfully get a GUI password prompt before the root shell will open.

On Arch Linux.

[ Parent | on HN ]