CVE-2018-8885 Race condition in n/a
Local attackers can exploit a race condition in screen-resolution-extra to bypass access restrictions and escalate privileges via mishandled PolicyKit calls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-8885?
CVE-2018-8885 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 28 Mar 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
screenresolution-mechanism in screen-resolution-extra 0.17.2 does not properly use the PolicyKit D-Bus API, which allows local users to bypass intended access restrictions by leveraging a race condition via a setuid or pkexec process that is mishandled in a PolicyKitService._check_permission call.
Weakness: CWE-362
Which versions are affected by CVE-2018-8885?
It affects 2 products.
Products include Canonical Screen-Resolution-Extra, Canonical Ubuntu Linux.
How do I fix CVE-2018-8885?
Apply the vendor's patch.
Is CVE-2018-8885 being exploited?
There is no known exploitation of CVE-2018-8885 in the wild and no public exploit code.
Sources
Also known as GHSA-wpjr-f7r3-fjvc, UBUNTU-CVE-2018-8885, USN-3607-1.