https://blog.mirch.io/tags/polkit/ Recent content in polkit on Rich Mirch Hugo en-us Sun, 09 Dec 2018 19:32:04 +0000 https://blog.mirch.io/2018/12/09/cve-2018-19788-poc-polkit-improper-handling-of-user-with-uid-int_max-leading-to-authentication-bypass/ Sun, 09 Dec 2018 19:32:04 +0000 https://blog.mirch.io/2018/12/09/cve-2018-19788-poc-polkit-improper-handling-of-user-with-uid-int_max-leading-to-authentication-bypass/ <p>While reviewing my Twitter feed I noticed a recent popular tweet from <a href="https://twitter.com/0xdea">@0xdea</a>. <a href="https://twitter.com/0xdea/status/1070308598146850818">https://twitter.com/0xdea/status/1070308598146850818</a> I was intrigued and wanted to see if there was a way to leverage this to execute arbitrary code as root.</p> <p>First we need to understand what the value of INT_MAX is. Fortunately the getconf command can be used to find the value or you can find it in /usr/include/limits.h.</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="o">[</span>root@localhost ~<span class="o">]</span><span class="c1"># getconf INT_MAX</span> </span></span><span class="line"><span class="cl"><span class="m">2147483647</span> </span></span><span class="line"><span class="cl"><span class="o">[</span>root@localhost ~<span class="o">]</span><span class="c1"># grep &#39;define INT_MAX&#39; /usr/include/limits.h</span> </span></span><span class="line"><span class="cl"><span class="c1"># define INT_MAX 2147483647</span> </span></span></code></pre></div><p>To exploit the vulnerability the user must have a UID value larger than 2147483647. I used the same value of 4000000000 that <a href="https://twitter.com/0xdea">@0xdea</a> posted.</p>