Skip to content

Comments

polkit: fix local privilege escalation in pkexec#156750

Merged
jonringer merged 1 commit intoNixOS:masterfrom
mweinelt:polkit
Jan 25, 2022
Merged

polkit: fix local privilege escalation in pkexec#156750
jonringer merged 1 commit intoNixOS:masterfrom
mweinelt:polkit

Conversation

@mweinelt
Copy link
Member

@mweinelt mweinelt commented Jan 25, 2022

Motivation for this change

We discovered a Local Privilege Escalation (from any user to root) in
polkit's pkexec, a SUID-root program that is installed by default on
every major Linux distribution

https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

Fixes: CVE-2021-4034

Things done
  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 22.05 Release Notes (or backporting 21.11 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
    • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
  • Fits CONTRIBUTING.md.

@mweinelt mweinelt added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Jan 25, 2022
@K900

This comment has been minimized.

Sign in to view
@grahamc
Copy link
Member

grahamc commented Jan 25, 2022

Let's retarget to master and merge a backport immediately.

@mweinelt
polkit: fix local priviledge escalation in pkexec
9e01b06 
> We discovered a Local Privilege Escalation (from any user to root) in
> polkit's pkexec, a SUID-root program that is installed by default on
> every major Linux distribution

https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

Fixes: CVE-2021-4034
@mweinelt mweinelt changed the base branch from staging to master January 25, 2022 19:07
@mweinelt mweinelt removed the request for review from zowoq January 25, 2022 19:07
@jonringer
Copy link
Contributor

jonringer commented Jan 25, 2022

may as well merge staging-next if this is going to be a large rebuild

@grahamc
Copy link
Member

grahamc commented Jan 25, 2022

@jonringer are there any changes in staging-next which may delay this fix being released? If not, I'm okay with that. However, if there is any risk of it, we should hold off.

@mweinelt
Copy link
Member Author

mweinelt commented Jan 25, 2022

Should be in the 2.5k-5k range for linux looking at the history.

@jonringer
Copy link
Contributor

jonringer commented Jan 25, 2022

@jonringer are there any changes in staging-next which may delay this fix being released? If not, I'm okay with that. However, if there is any risk of it, we should hold off.

it was close to being merged anyway. Mostly waiting on darwin builds

@ofborg ofborg bot added 10.rebuild-darwin: 11-100 This PR causes between 11 and 100 packages to rebuild on Darwin. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-linux: 2501-5000 This PR causes many rebuilds on Linux and should target the staging branches. labels Jan 25, 2022
@jonringer
Copy link
Contributor

jonringer commented Jan 25, 2022 •
edited
Loading 

$ ./maintainers/scripts/rebuild-amount.sh HEAD^ HEAD
Estimating rebuild amount by counting changed Hydra jobs (parallel=unset).
   2312 x86_64-linux

jonringer
jonringer approved these changes Jan 25, 2022
View reviewed changes
Copy link
Contributor

@jonringer jonringer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

https://github.com/NixOS/nixpkgs/pull/156750

1 package built:
polkit

@github-actions github-actions bot mentioned this pull request Jan 25, 2022
Merged
1 task
@github-actions
Copy link
Contributor

github-actions bot commented Jan 25, 2022

Successfully created backport PR #156758 for release-21.11.

@mweinelt mweinelt deleted the polkit branch January 25, 2022 20:15
jtojnar added a commit to jtojnar/nixfiles that referenced this pull request Jan 25, 2022
@jtojnar
common: Patch pkexec for CVE-2021-4034
732ebdb 
NixOS/nixpkgs#156750
@benley
Copy link
Member

benley commented Jan 26, 2022

Any chance this can be backported to nixos-20.09 as well?

@jonringer
Copy link
Contributor

jonringer commented Jan 26, 2022 •
edited
Loading

Any chance this can be backported to nixos-20.09 as well?

It wouldn't do much, the related hydra jobs have been discontinued. So there's no CI/CD which will bump the release branches.

https://status.nixos.org/

@benley
Copy link
Member

benley commented Jan 26, 2022

Any chance this can be backported to nixos-20.09 as well?

It wouldn't do much, they related hydra jobs have been discontinued. So there's no CI/CD which will bump the release branches.

https://status.nixos.org/

Oh right, fair enough. I spaced out and forgot what year it is, thinking 20.09 was just a few months old.

@sugar700
Copy link
Member

sugar700 commented Jan 26, 2022 •
edited
Loading

Managed to exploit the vulnerability, and this patch appears to fix it for me. On sidenote, I think adding a requirement that argc >= 1 to wrapper.c could make sense, and I think I will do that in another pull request.

@sugar700 sugar700 mentioned this pull request Jan 26, 2022
Merged
13 tasks
@Izorkin
Copy link
Contributor

Izorkin commented Jan 26, 2022

Can be backported to nixos-21.05?

@raboof raboof mentioned this pull request Jan 26, 2022
Closed
13 tasks
@raboof raboof changed the title polkit: fix local priviledge escalation in pkexec polkit: fix local privilege escalation in pkexec Jan 26, 2022
@mweinelt
Copy link
Member Author

mweinelt commented Jan 26, 2022 •
edited
Loading

Can be backported to nixos-21.05?

NixOS 21.05 has reached its end-of-life around new years. That is when we stopped backporting security patches. Backporting polkit now and ignoring every security issue that affects 21.05 would provide weird security guarantees, which is why I oppose that scenario.

If you are still on NixOS 21.05 I recommend upgrading as soon as possible, in the meantime you can either disable polkit if you don't need it (security.polkit.enable) or use an overlay to apply this patch.

@mweinelt
Copy link
Member Author

mweinelt commented Jan 26, 2022

Managed to exploit the vulnerability, and this patch appears to fix it for me. On sidenote, I think adding a requirement that argc >= 1 to wrapper.c could make sense, and I think I will do that in another pull request.

There is also an effort to resolve this kind of issue in the kernel.

v1 https://lore.kernel.org/lkml/20220126043947.10058-1-ariadne@dereferenced.org/T/
v2 https://lore.kernel.org/lkml/20220126114447.25776-1-ariadne@dereferenced.org/T/

via https://twitter.com/ariadneconill/status/1486199140929490949

@Izorkin
Copy link
Contributor

Izorkin commented Jan 26, 2022

I am using unstable channel. Version 21.05 is used in one of the projects.

@mohe2015
Copy link
Contributor

mohe2015 commented Jan 26, 2022

I am using unstable channel. Version 21.05 is used in one of the projects.

Then tell them to update :)

@codygman codygman mentioned this pull request Jan 26, 2022
Merged
4 tasks
@nixos-discourse
Copy link

nixos-discourse commented Jan 28, 2022

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/cve-2022-0185-and-hardened-kernel/17346/3

@nixos-discourse
Copy link

nixos-discourse commented Jan 30, 2022

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/cve-2022-0185-and-hardened-kernel/17346/4

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jtojnar jtojnar Awaiting requested review from jtojnar

1 more reviewer

@jonringer jonringer jonringer approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

1.severity: security Issues which raise a security issue, or PRs that fix one 10.rebuild-darwin: 11-100 This PR causes between 11 and 100 packages to rebuild on Darwin. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-linux: 2501-5000 This PR causes many rebuilds on Linux and should target the staging branches.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

9 participants

@mweinelt @K900 @grahamc @jonringer @benley @sugar700 @Izorkin @mohe2015 @nixos-discourse