CVE-2021-4115

There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned

polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.

Security Fix(es):

There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned(CVE-2021-4115)

The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones.

Security Fix(es):

• polkit: file descriptor leak allows an unprivileged user to cause a crash (CVE-2021-4115)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned

The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones.

Security Fix(es):

• polkit: file descriptor leak allows an unprivileged user to cause a crash (CVE-2021-4115)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2021-4115: file decriptor leak due to incorrect handling of async streams in src/polkit/polkitsystembusname.c

• CVE-2021-4115: file decriptor leak due to incorrect handling of async streams in src/polkit/polkitsystembusname.c

There is a file descriptor leak in polkit, which can enable an unprivileged user to cause polkit to crash, due to file descriptor exhaustion. (CVE-2021-4115)

This update for polkit fixes the following issues:

• CVE-2021-4115: Fixed a denial of service via file descriptor leak (bsc#1195542).

These are all security issues fixed in the libpolkit-agent-1-0-0.120-3.1 package on the GA media of openSUSE Tumbleweed.

This update for polkit fixes the following issues:

• CVE-2021-4115: Fixed a denial of service via file descriptor leak (bsc#1195542).

This update for polkit fixes the following issues:

• CVE-2021-4115: Fixed a denial of service via file descriptor leak (bsc#1195542).

This update for polkit fixes the following issues:

• CVE-2021-4115: Fixed a denial of service via file descriptor leak (bsc#1195542).

Kevin Backhouse discovered that PolicyKit incorrectly handled file descriptors. A local attacker could possibly use this issue to cause PolicyKit to crash, resulting in a denial of service.