hohn/codeql-sample-polkit
1
0
Fork 0
mirror of https://github.com/hohn/codeql-sample-polkit.git synced 2025-12-16 13:53:04 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update README

Browse Source
This commit is contained in:
Michael Hohn
2022-03-07 10:00:29 -08:00
committed by =Michael Hohn
parent 9e8345152e
commit 2ee15c9dca
1 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
README.org
View File

@@ -1,12 +1,23 @@
# -*- coding: utf-8 -*- # -*- coding: utf-8 -*-
* The polkit pkexec bug * The polkit pkexec bug
This is *work in progress*: ** Overview
- [X] the polkit source / database build are complete This repository examines the polkit pkexec bug using CodeQL.
- [ ] codeql query development It has
- [ ] command-line instructions - instructions for building the databases
- the resultant databases
- a sequence of queries illustrating an approach to find this bug
These are done:
- [X] the polkit source / database build
- [X] codeql query for vulnerable source
- [X] CFG illustration
Still to be done:
- [ ] codeql query enhancements to also handle patched source
- [ ] command-line instructions
** The Bug
The Polkit pkexec bug [[https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034][(CVE-2021-4034)]] The Polkit pkexec bug [[https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034][(CVE-2021-4034)]]
starts from an array bounds error w.r.t. argv and starts from an array bounds error w.r.t. argv and
builds on that. The out-of-bounds part of the problem is something we builds on that. The out-of-bounds part of the problem is something we
@@ -77,7 +88,7 @@
The next section goes through the build steps, using a Docker container. The next section goes through the build steps, using a Docker container.
** Build polkit and codeql db ** Build polkit and CodeQL DB
We need the build setup for polkit before we can get a codeql database. We need the build setup for polkit before we can get a codeql database.
Operating system options for building: Operating system options for building: