Re: pwnkit: Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)

[Dominik Czarnota <dominik.b.czarnota () gmail com>]

Hi,

And many other binaries also do things incorrectly:
- https://grep.app/search?q=%3D%201%3B%20n%20%3C%20argc
- https://grep.app/search?q=%3D%201%3B%20.%20%3C%20argc&regexp=true

But most of them are not suid binaries and also do not perform a write into
argv[].

Cheers,
Disconnect3d

On Wed, 26 Jan 2022 at 13:52, Matthias Schmidt <oss-sec () xosc org> wrote:

> Hi,
>
> * Qualys Security Advisory wrote:
> > Qualys Security Advisory
> >
> > pwnkit: Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)
>
> This was already mentioned in 2013 in a blog post, however, it seems the
> author didn't realize the consequences of their finding:
>
> https://ryiron.wordpress.com/2013/12/16/argv-silliness/
>
> Cheers
>
>         Matthias