{"id":"CVE-2016-2568","aliases":["AZL-35109","AZL-6800","DEBIAN-CVE-2016-2568","EUVD-2016-3642","GHSA-8vgc-x7hv-3g84","UBUNTU-CVE-2016-2568"],"status":"published","title":"pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a...","description":"pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00366,"percentile":0.30645,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116"],"published":"2017-02-13T18:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"polkit","fixed_in":["123-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"policykit-1","fixed_in":["123-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"policykit-1","fixed_in":["123-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"123-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.119-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["122-3","122-4","123-1","123-2","123-3","124-1","124-2","124-3","125-1","125-2","126-1","126-2","127-1","127-2","127-3"]},{"source":"osv","ecosystem":"Debian:13","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"123-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"123-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.105-3ubuntu3","0.105-4ubuntu1","0.105-4ubuntu2","0.105-4ubuntu2.14.04.1","0.105-4ubuntu3.14.04.1","0.105-4ubuntu3.14.04.2","0.105-4ubuntu3.14.04.5","0.105-4ubuntu3.14.04.6","0.105-4ubuntu3.14.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.105-11ubuntu2","0.105-13","0.105-13ubuntu1","0.105-14","0.105-14.1","0.105-14.1ubuntu0.1","0.105-14.1ubuntu0.4","0.105-14.1ubuntu0.5","0.105-14.1ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.105-18","0.105-20","0.105-20ubuntu0.18.04.1","0.105-20ubuntu0.18.04.4","0.105-20ubuntu0.18.04.5","0.105-20ubuntu0.18.04.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.105-26ubuntu1","0.105-26ubuntu1.1","0.105-26ubuntu1.2","0.105-26ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.105-31","0.105-31ubuntu1","0.105-31.1","0.105-32","0.105-33","0.105-33ubuntu0.1","0.105-33ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["123-1","123-3","124-1","124-1ubuntu1","124-2ubuntu1","124-2ubuntu1.24.04.2","124-2ubuntu1.24.04.3","124-2ubuntu1.24.04.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["126-2","126-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["127-2ubuntu1","127-3","127-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["126-2","127-1","127-2","127-2ubuntu1","127-2ubuntu1.1"]}],"products":[{"vendor":"freedesktop","product":"polkit"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/02/26/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1300746","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://access.redhat.com/security/cve/cve-2016-2568","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-2568","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816062","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2568","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8vgc-x7hv-3g84"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2568","tags":["advisory"]},{"url":"http://seclists.org/oss-sec/2016/q1/443","tags":["report"]},{"url":"https://lore.kernel.org/patchwork/patch/793178/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2568","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-2568","description":"pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-13T18:00:00Z","modified":"2026-10-08T21:14:04.48Z","updated_at":"2026-11-02T14:33:33.424551Z"}],"euvd":[{"id":"EUVD-2016-3642","description":"pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-13T18:00:00Z","modified":"2026-10-08T21:14:04Z","updated_at":"2026-11-02T17:27:26.452288Z"}],"ghsa":[{"id":"GHSA-8vgc-x7hv-3g84","title":"pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a...","description":"pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2022-05-13T01:02:15Z","modified":"2023-02-01T05:02:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:49:55.565803Z"}],"nvd":[{"id":"CVE-2016-2568","description":"pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-13T18:59:00.393Z","modified":"2026-10-08T22:16:38.407Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:03:35.822579Z"}],"osv":[{"id":"AZL-35109","title":"CVE-2016-2568 affecting package polkit for versions less than 123-1","description":"pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-13T18:59:00Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-6800","title":"CVE-2016-2568 affecting package polkit 0.119-4","description":"pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-13T18:59:00Z","modified":"2026-04-21T04:38:18.826414Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"CVE-2016-2568","description":"pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-13T18:59:00.393Z","modified":"2026-03-15T22:02:43.636078Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2568","description":"pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-13T18:59:00.393Z","modified":"2026-10-09T01:47:28.964863339Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-2568","description":"pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-13T18:59:00Z","modified":"2026-10-17T12:52:54.181042153Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.872222Z"}]}}