PT-2016-3438 · Policykit+2 · Pkexec+2

Adam Mariš · Published 2016-01-24 · Updated 2022-04-18 · CVE-2016-2568

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pkexec versions (affected versions not specified)

Description The issue allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer. This is related to the use of pkexec with the --user nonpriv option. The vulnerability is also described as being related to an insufficient encoding or escaping mechanism in the Policykit platform, which could allow an attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

AZL-35109

AZL-6800

BDU:2022-06884

CVE-2016-2568

Affected Products

Astra Linux

Debian

Pkexec

References · 20

• https://osv.dev/vulnerability/AZL-6800 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-2568 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-2568 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1110SE17 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06884 · Security Note
• https://osv.dev/vulnerability/CVE-2016-2568 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2568 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2568 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2568 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35109 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-2568 · Vendor Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816062 · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=812512 · Note
• https://lore.kernel.org/patchwork/patch/793178 · Note