CVE-2015-3218

What it actually does

Local unauthenticated call to RegisterAuthenticationAgent with an invalid D-Bus object path triggers a NULL pointer dereference inside polkitbackendinteractiveauthority.c, causing the polkitd daemon to crash.

Why it matters to the business

A local user on an affected system can repeatedly terminate the central authentication policy service, interrupting any process that relies on polkit for privilege decisions and potentially causing service outages on desktops or servers that use the framework.

How an attack unfolds

An attacker with a local shell invokes the RegisterAuthenticationAgent D-Bus method on the org.freedesktop.PolicyKit1.Authority interface, supplying a deliberately malformed object path; the daemon dereferences a NULL pointer during authority registration and terminates.

How to fix it

Upgrade polkit to version 0.113 or later; if an upgrade is not immediately possible, restrict local accounts that can connect to the system bus or run polkitd under a watchdog that restarts it automatically.

How to confirm the fix worked

Confirm the installed polkit package version is at least 0.113; optionally execute a benign test binary that performs the RegisterAuthenticationAgent call with a valid path and verify the daemon remains running.

Typical attack path

1. Obtain a local shell or user account on the target host
2. Locate or compile a small D-Bus client that calls RegisterAuthenticationAgent
3. Supply an invalid object path (for example, a path that does not begin with a slash or is otherwise malformed)
4. Invoke the method; observe polkitd crash and subsequent authentication failures

How to detect it

Search system and journal logs for repeated polkitd process crashes or segmentation faults around the time of authentication failures; look for D-Bus method calls to org.freedesktop.PolicyKit1.Authority.RegisterAuthenticationAgent originating from unprivileged local processes.

• polkitd.*segfault
• polkitbackendinteractiveauthority.c
• RegisterAuthenticationAgent

What your security team should do

• Apply the 0.113 (or newer) update to all systems running the affected polkit version
• Review local user accounts and remove unnecessary privileges that allow D-Bus access
• Monitor system logs for repeated polkitd crashes as a compensating control until patches are deployed