CVE-2018-19788

A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command.

CVSS v3.0 NVD

8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

11.58% chance of exploitation in the next 30 days, 96th percentile

Published

2018-12-03

Updated

2024-08-29

Proof-of-concept exploits (4)

• AbsoZed/CVE-2018-197885★ · 2018-12-07
• Ekultek/PoC19★ · 2018-12-18
• d4gh0s7/CVE-2018-197883★ · 2018-12-10
• jhlongjr/CVE-2018-197881★ · 2018-12-31

Security advisories

• https://bugs.debian.org/915332
• https://gitlab.freedesktop.org/polkit/polkit/issues/74
• https://lists.debian.org/debian-lts-announce/2019/01/msg00021.html
• https://usn.ubuntu.com/3861-1
• https://usn.ubuntu.com/3861-2
• https://www.debian.org/security/2018/dsa-4350

References

• CVE Record
• NVD entry

Related

• CVE-2018-1235
• CVE-2018-11776
• CVE-2019-0708
• CVE-2019-17625
• CVE-2019-7216