CVE-2015-3218

Severity

21%

Complexity

39%

Confidentiality

48%

CWE-476: NULL Pointer Dereference

The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path.

CWE-476: NULL Pointer Dereference

CVSS 2.0 Base Score 2.1. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:P).

Overview

First reported 9 years ago

2015-10-26 19:59:00

Last updated 6 years ago

2018-07-18 01:29:00

Affected Software

Polkit Project Policykit (aka polkit)

References

FEDORA-2015-11058

FEDORA-2015-11743

[polkit-devel] 20150702 polkit-0.113 released

[polkit-devel] 20150529 Crash authentication_agent_new with invalid object path in RegisterAuthenticationAgent

[polkit-devel] 20150630 Crash authentication_agent_new with invalid object path in RegisterAuthenticationAgent

openSUSE-SU-2015:1734

openSUSE-SU-2015:1927

76086

1035023

USN-3717-1

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.