Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Polkit lets a local user gain higher privileges

published 9 years ago
Summary

The polkit component used in Azure environments can be tricked by a regular user to break out of a limited session and act with higher rights. This could let an insider perform actions they should not be able to. Update polkit to the latest version or apply the vendor’s security patch to stop this behavior.

What to do
  • Update azure polkit to version 123-1.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure polkit < 123-1
Fix: upgrade to 123-1
Original advisory text
CVE-2016-2568 affecting package polkit for versions less than 123-1
pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Timeline
Published13 Feb 2017
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-35109 · OSV
Track software like this
Free during beta