Unprivileged attackers can get a root shell by exploiting an authentication bypass vulnerability in the polkit auth system service installed by default on many modern Linux distributions.
Even though many Linux distributions haven't shipped with the vulnerable polkit version until recently, any Linux system shipping with polkit 0.113 or later installed is exposed to attacks.
The list of currently vulnerable distros shared by Backhouse includes popular distros such as RHEL 8, Fedora 21 (or later), Ubuntu 20.04, as well as unstable versions like Debian testing ('bullseye') and its derivatives.
Exploiting the vulnerability is surprisingly easy as it only takes a few terminal commands using only standard tools such as bash, kill, and dbus-send — a video demo provided by Backhouse is embedded below.
"When a requesting process disconnects from dbus-daemon just before the call to polkit_system_bus_name_get_creds_sync starts, the process cannot get a unique uid and pid of the process and it cannot verify the privileges of the requesting process," Red ..
Support the originator by clicking the read the rest link below.