A high-severity authentication bypass vulnerability in the zbus_polkit crate allows local unprivileged attackers to escalate privileges by exploiting a race condition during polkit authorization.

The vulnerability stems from a type mismatch in the Subject::new_for_owner function, where a UID is encoded as an unsigned 32-bit integer instead of the required signed 32-bit integer. This causes the system to discard the caller supplied UID and perform an insecure PID lookup in /proc, which a local unprivileged attacker can exploit to spoof an authorized process.

The vulnerability carries a CVSS score of 7.3, reflecting its high potential for local privilege escalation and unauthorized system actions. Successful exploitation allows a local attacker to bypass critical security controls, potentially leading to full system compromise or the execution of unauthorized commands with the privileges of a target process. This represents a significant risk for systems relying on polkit for access control management.

Immediate Action: Update the zbus_polkit crate to version 5.1.0 or later to resolve the type mismatch and secure the authorization process.

Proactive Monitoring: Monitor system logs for unusual process termination events or unexpected authorization requests that might indicate an attacker attempting to win the race condition.

Compensating Controls: Ensure that local access is strictly controlled and limit the ability of unprivileged users to execute processes that interact with sensitive polkit-protected services.

Public Exploit Available: No (exploit_available: false)

Given the severity of this authentication bypass, organizations utilizing the zbus_polkit crate must prioritize patching to version 5.1.0. Failure to address this vulnerability allows local attackers to circumvent security boundaries, making immediate remediation essential for maintaining the integrity of the authorization layer.