Does anyone know if this will affect us?
- I run omv-update today and no updates found. Furthermore,
- i run apt-get update from CLI but still no updates found.
Is there anything else to be done besides the above two steps?
Polkit's pkexec component identified as CVE-2021-4034 (PwnKit)
-
- OMV 5.x
- FragoulisNaval
-
-
Thank you for your reply. and how we can check what we have installed?
Well, you've provided a wealth of info about your system...
What version of OMV are you using.
-
Maybe dpkg -l | grep polkit will show the versions (although I don't see it in the VM i'm running)
Don't think that it's installed on a Lite system.
-
Well, you've provided a wealth of info about your system...
What version of OMV are you using.
Version: 5.6.24-1
Kernel: Linux 5.10.0-0.bpo.9-amd64
Sorry for the lack of info provided but i thought that this is a generic issue
-
Maybe dpkg -l | grep polkit will show the versions (although I don't see it in the VM i'm running)
Don't think that it's installed on a Lite system.
That's what I was thinking (and Google seems to suggest such), but I wasn't 100% sure. I'm pretty sure it's only there w/ GUI desktops.. which means he's not running a proper install anyway and is gonna be disappointed when he updates.
-
Maybe dpkg -l | grep polkit will show the versions (although I don't see it in the VM i'm running)
Don't think that it's installed on a Lite system.
same here, nothign shown
-
My x86 install also found no updates and dpkg -l | grep polkit returned nothing. However, my RPi install had the following updates available:
Code$ apt list --upgradeable Listing... Done libpolkit-agent-1-0/oldstable 0.105-25+rpt1+deb10u1 armhf [upgradable from: 0.105-25+rpt1] libpolkit-backend-1-0/oldstable 0.105-25+rpt1+deb10u1 armhf [upgradable from: 0.105-25+rpt1] libpolkit-gobject-1-0/oldstable 0.105-25+rpt1+deb10u1 armhf [upgradable from: 0.105-25+rpt1] policykit-1/oldstable 0.105-25+rpt1+deb10u1 armhf [upgradable from: 0.105-25+rpt1] rpi-eeprom/oldstable 13.5-1~buster armhf [upgradable from: 13.4-1~buster]After running apt full-upgrade on the RPi, dpkg -l | grep polkit returns the following:
Code$ dpkg -l | grep polkit ii libpolkit-agent-1-0:armhf 0.105-25+rpt1+deb10u1 armhf PolicyKit Authentication Agent API ii libpolkit-backend-1-0:armhf 0.105-25+rpt1+deb10u1 armhf PolicyKit backend API ii libpolkit-gobject-1-0:armhf 0.105-25+rpt1+deb10u1 armhf PolicyKit Authorization API -
My x86 install also found no updates and dpkg -l | grep polkit returned nothing. However, my RPi install had the following updates available:
Code$ apt list --upgradeable Listing... Done libpolkit-agent-1-0/oldstable 0.105-25+rpt1+deb10u1 armhf [upgradable from: 0.105-25+rpt1] libpolkit-backend-1-0/oldstable 0.105-25+rpt1+deb10u1 armhf [upgradable from: 0.105-25+rpt1] libpolkit-gobject-1-0/oldstable 0.105-25+rpt1+deb10u1 armhf [upgradable from: 0.105-25+rpt1] policykit-1/oldstable 0.105-25+rpt1+deb10u1 armhf [upgradable from: 0.105-25+rpt1] rpi-eeprom/oldstable 13.5-1~buster armhf [upgradable from: 13.4-1~buster]After running apt full-upgrade on the RPi, dpkg -l | grep polkit returns the following:
Code$ dpkg -l | grep polkit ii libpolkit-agent-1-0:armhf 0.105-25+rpt1+deb10u1 armhf PolicyKit Authentication Agent API ii libpolkit-backend-1-0:armhf 0.105-25+rpt1+deb10u1 armhf PolicyKit backend API ii libpolkit-gobject-1-0:armhf 0.105-25+rpt1+deb10u1 armhf PolicyKit Authorization APIDo you run the Pi with a Desktop version?
-
Scratch my last comment:
All my Pis received the updates so, all goes well in the world
-
To calm people's fears on this:
- The package name is policykit-1 on Debian
- It is installed by default on all installs (including Raspberry Pi OS and Armbian)not just on desktops
- The only place I have found it is used on a headless server is when you run the reboot command as yourself instead of root or sudo. It will try to elevate privileges to root. Worthless in my book. So, it can be uninstalled in my opinion.
- OMV 5.x and 6.x should have installed the update automatically. It doesn't require a reboot to be effective either.
- It requires local access to exploit. So, unless someone can login to your system, you have little to worry about.
Note: I got to patch thousands of systems yesterday because of this.
Jetzt mitmachen!
Sie haben noch kein Benutzerkonto auf unserer Seite? Registrieren Sie sich kostenlos und nehmen Sie an unserer Community teil!