Unbounded Input DoS in polkit-agent-helper-1 Setuid Binary

Executive Summary

CVE-2026-4897 is a vulnerability in polkit's setuid helper binary called polkit-agent-helper-1. A local user can exploit this by providing a specially crafted, excessively long input through standard input (stdin). The helper reads this input using the getline() function without limiting the input length, which causes unbounded memory allocation.

Because the input length is not limited, the program keeps allocating more memory until the system runs out of memory (OOM) or an error occurs. This leads to a Denial of Service (DoS) condition, making the system unresponsive or unstable.

The vulnerability arises because a check to see if stdin is a terminal (using isatty()) happens too late, after the unbounded memory allocation has already occurred. Also, this check only blocks terminal input but not other input sources like pipes, which can be exploited by an attacker.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to reproduce the unbounded input condition on the vulnerable setuid binary `polkit-agent-helper-1`. A local user can test for the vulnerability by providing a very large input without a newline to the helper via stdin.

An example command to test the vulnerability is:

• python3 -c "print('A'*200000000, end='')" | /usr/lib/polkit-1/polkit-agent-helper-1 $(whoami)

If the system experiences an out-of-memory (OOM) condition or the helper crashes, it indicates the presence of the vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a local attacker to cause a Denial of Service (DoS) on your system. By exploiting the unbounded input processing in the polkit-agent-helper-1 binary, an attacker can cause the system to run out of memory.

When the system runs out of memory, it can become unresponsive or crash, disrupting normal operations and potentially requiring a reboot or manual intervention to restore service.

Since the vulnerable binary runs with setuid root permissions, any local user can trigger this condition, making it a significant risk on multi-user systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a local user to cause a denial of service (DoS) by triggering unbounded memory allocation in the polkit setuid helper. While it impacts system availability, there is no information provided about any impact on confidentiality, integrity, or data exposure.

Common standards and regulations such as GDPR and HIPAA emphasize the protection of personal data confidentiality, integrity, and availability. A denial of service could affect availability, but since this vulnerability does not involve unauthorized data access or modification, its direct impact on compliance with these regulations is limited to potential availability concerns.

No explicit information is provided in the context or resources about compliance implications or mitigation steps related to regulatory standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting local user access to the vulnerable setuid binary `polkit-agent-helper-1` to prevent exploitation.

Since the vulnerability arises from unbounded input processing on stdin, avoid allowing untrusted or unfiltered input to be piped into this binary.

Applying vendor patches or updates that fix the unbounded input handling in the `read_cookie()` function is the recommended long-term solution.

If patches are not immediately available, consider disabling or restricting the use of the setuid helper binary or using alternative authentication methods that do not invoke this vulnerable helper.

Useful 0 Not Useful 0