1. 修复的CVE
CVE-2021-4034
polkit是一个在类 Unix操作系统中控制系统范围权限的组件。通过定义和审核权限规则,实现不同优先级进程间的通讯。polkit 的 pkexec application存在安全漏洞,攻击者可利用该漏洞通过精心设计环境变量诱导pkexec执行任意代码。成功执行攻击后,如果目标计算机上没有权限的用户拥有管理权限,攻击可能会导致本地权限升级。
·银河和记官网登录桌面操作系统V10 SP1
arm64 架构:
gir1.2-polkit-1.0、libpolkit-agent-1-0、libpolkit-gobject-1-0、policykit-1
x86_64 架构:
gir1.2-polkit-1.0、libpolkit-agent-1-0、libpolkit-gobject-1-0、policykit-1
mips64el 架构:
gir1.2-polkit-1.0、libpolkit-agent-1-0、libpolkit-gobject-1-0、policykit-1
loongarch64 架构:
gir1.2-polkit-1.0、libpolkit-agent-1-0、libpolkit-gobject-1-0、policykit-1
·银河和记官网登录桌面操作系统V10 SP1
gir1.2-polkit-1.0_0.105-26kylin1.2
libpolkit-agent-1-0_0.105-26kylin1.2
libpolkit-gobject-1-0_0.105-26kylin1.2
policykit-1_0.105-26kylin1.2
方法一:修改 pkexec的权限:
$sudo chmod 0755 /usr/bin/pkexec
通过补丁包下载地址下载补丁包,使用软件包升级命令根据受影响的软件包列表 升级相关的组件。
$sudo dpkg -i Packagelists
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/gir1.2-polkit-1.0_0.105-26kylin1.2_amd64.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-agent-1-0_0.105-26kylin1.2_amd64.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-gobject-1-0_0.105-26kylin1.2_amd64.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/policykit-1_0.105-26kylin1.2_amd64.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/gir1.2-polkit-1.0_0.105-26kylin1.2_arm64.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-agent-1-0_0.105-26kylin1.2_arm64.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-gobject-1-0_0.105-26kylin1.2_arm64.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/policykit-1_0.105-26kylin1.2_arm64.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/gir1.2-polkit-1.0_0.105-26kylin1.2_mips64el.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-agent-1-0_0.105-26kylin1.2_mips64el.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-gobject-1-0_0.105-26kylin1.2_mips64el.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/policykit-1_0.105-26kylin1.2_mips64el.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/gir1.2-polkit-1.0_0.105-26kylin1.2_loongarch64.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-agent-1-0_0.105-26kylin1.2_loongarch64.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-gobject-1-0_0.105-26kylin1.2_loongarch64.deb
https://archive.cq-jq.com/kylin/KYLIN-ALL/pool/policykit-1/policykit-1_0.105-26kylin1.2_loongarch64.deb
注:其他相关依赖包请到相同目录下载
使用软件包查询命令,查看相关的软件包版本与修复版本一致则成功修复。
$sudo dpkg -l |grep Packagename