CVE-2018-19788 PoC - polkit: Improper handling of user with uid > INT_MAX leading to authentication bypass
While reviewing my Twitter feed I noticed a recent popular tweet from @0xdea. https://twitter.com/0xdea/status/1070308598146850818 I was intrigued and wanted to see if there was a way to leverage this to execute arbitrary code as root. First we need to understand what the value of INT_MAX is. Fortunately the getconf command can be used to find the value or you can find it in /usr/include/limits.h. [root@localhost ~]# getconf INT_MAX 2147483647 [root@localhost ~]# grep 'define INT_MAX' /usr/include/limits.h # define INT_MAX 2147483647 To exploit the vulnerability the user must have a UID value larger than 2147483647. I used the same value of 4000000000 that @0xdea posted. ...