CVE-2018-8885

screenresolution-mechanism in screen-resolution-extra 0.17.2 does not properly use the PolicyKit D-Bus API, which allows local users to bypass intended access restrictions by leveraging a race condition via a setuid or pkexec process that is mishandled in a PolicyKitService._check_permission call.

Score

CVSS 3.0 7.0 High

Status

Modified - cve@mitre.org

Published

2018-03-28

Last modified

2024-08-05

Weaknesses

CWE-362

Affected products

• Screen-resolution-extra (Canonical)
• Ubuntu Linux (Canonical)

References

• https://usn.ubuntu.com/3607-1/