There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the polkit-0.117-9.el9 build changelog.

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the polkit-0.117-10.el9 build changelog.

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-026 advisory.

  - A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is     a setuid tool designed to allow unprivileged users to run commands as privileged users according     predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly     and ends trying to execute environment variables as commands. An attacker can leverage this by crafting     environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully     executed the attack can cause a local privilege escalation given unprivileged users administrative rights     on the target machine. (CVE-2021-4034)

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0525-2 advisory.

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of polkit installed on the remote host is prior to 0.117-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-220 advisory.

  - A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is     a setuid tool designed to allow unprivileged users to run commands as privileged users according     predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly     and ends trying to execute environment variables as commands. An attacker can leverage this by crafting     environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully     executed the attack can cause a local privilege escalation given unprivileged users administrative rights     on the target machine. (CVE-2021-4034)

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the polkit packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is     a setuid tool designed to allow unprivileged users to run commands as privileged users according     predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly     and ends trying to execute environment variables as commands. An attacker can leverage this by crafting     environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully     executed the attack can cause a local privilege escalation given unprivileged users administrative rights     on the target machine. (CVE-2021-4034)

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-102 advisory.

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-097 advisory.

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the polkit packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1546 advisory.

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1546 advisory.

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1546 advisory.

  - polkit: file descriptor leak allows an unprivileged user to cause a crash (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of polkit installed on the remote host is prior to 0.120. It is, therefore, affected by a vulnerability as referenced in the SSA:2022-071-01 advisory.

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 21.10 host has packages installed that are affected by a vulnerability as referenced in the USN-5304-1 advisory.

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0524-1 advisory.

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0525-1 advisory.

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:0525-1 advisory.

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191324	CentOS 9 : polkit-0.117-9.el9	Nessus	CentOS Local Security Checks	medium
191323	CentOS 9 : polkit-0.117-10.el9	Nessus	CentOS Local Security Checks	medium
173080	Amazon Linux 2023 : polkit, polkit-devel, polkit-libs (ALAS2023-2023-026)	Nessus	Amazon Linux Local Security Checks	high
171197	SUSE SLES15 Security Update : polkit (SUSE-SU-2022:0525-2)	Nessus	SuSE Local Security Checks	medium
168576	Amazon Linux 2022 : polkit (ALAS2022-2022-220)	Nessus	Amazon Linux Local Security Checks	high
165930	EulerOS Virtualization 3.0.6.0 : polkit (EulerOS-SA-2022-2583)	Nessus	Huawei Local Security Checks	high
164740	Amazon Linux 2022 : (ALAS2022-2022-102)	Nessus	Amazon Linux Local Security Checks	medium
164721	Amazon Linux 2022 : (ALAS2022-2022-097)	Nessus	Amazon Linux Local Security Checks	medium
163615	EulerOS Virtualization 2.9.1 : polkit (EulerOS-SA-2022-2187)	Nessus	Huawei Local Security Checks	medium
163606	EulerOS Virtualization 2.9.0 : polkit (EulerOS-SA-2022-2206)	Nessus	Huawei Local Security Checks	medium
163187	EulerOS Virtualization 2.10.0 : polkit (EulerOS-SA-2022-2033)	Nessus	Huawei Local Security Checks	high
163123	EulerOS Virtualization 2.10.1 : polkit (EulerOS-SA-2022-2061)	Nessus	Huawei Local Security Checks	high
162293	EulerOS 2.0 SP9 : polkit (EulerOS-SA-2022-1874)	Nessus	Huawei Local Security Checks	medium
162273	EulerOS 2.0 SP9 : polkit (EulerOS-SA-2022-1850)	Nessus	Huawei Local Security Checks	medium
161863	EulerOS 2.0 SP10 : polkit (EulerOS-SA-2022-1796)	Nessus	Huawei Local Security Checks	medium
161854	EulerOS 2.0 SP10 : polkit (EulerOS-SA-2022-1813)	Nessus	Huawei Local Security Checks	medium
160293	Rocky Linux 8 : polkit (RLSA-2022:1546)	Nessus	Rocky Linux Local Security Checks	medium
160246	Oracle Linux 8 : polkit (ELSA-2022-1546)	Nessus	Oracle Linux Local Security Checks	medium
160240	RHEL 8 : polkit (RHSA-2022:1546)	Nessus	Red Hat Local Security Checks	medium
160155	EulerOS 2.0 SP8 : polkit (EulerOS-SA-2022-1580)	Nessus	Huawei Local Security Checks	medium
158886	Slackware Linux 15.0 / current polkit Vulnerability (SSA:2022-071-01)	Nessus	Slackware Local Security Checks	medium
158455	Ubuntu 20.04 LTS : PolicyKit vulnerability (USN-5304-1)	Nessus	Ubuntu Local Security Checks	medium
158233	SUSE SLED12 / SLES12 Security Update : polkit (SUSE-SU-2022:0524-1)	Nessus	SuSE Local Security Checks	medium
158226	SUSE SLED15 / SLES15 Security Update : polkit (SUSE-SU-2022:0525-1)	Nessus	SuSE Local Security Checks	medium
158218	openSUSE 15 Security Update : polkit (openSUSE-SU-2022:0525-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2021-4115

medium

Tenable Plugins

medium

medium

high

medium

high

high

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium