Executive brief
zbus_polkit is a Rust library that implements polkit authorization checks for D-Bus services. A type mismatch bug causes the library to send user IDs as unsigned integers instead of signed integers, preventing applications from supplying verified UIDs to defend against PID reuse attacks. As a result, a local attacker can reuse the PID of a terminated authorized process and gain unauthorized access to protected actions.
Technical details
Subject::new_for_owner() in zbus_polkit encodes the uid parameter as an unsigned 32-bit integer (D-Bus type 'u'), but the org.freedesktop.PolicyKit1.Authority interface specification requires a signed 32-bit integer (D-Bus type 'i'). This type mismatch causes polkit to silently discard the caller-supplied UID and instead determine the subject's owner by performing an inherently racy lookup of the PID in /proc. An unprivileged local attacker can exploit the resulting race condition by causing an authorized process to terminate, winning the race to obtain the same PID, and then be authorized under the identity of the terminated process. Applications that attempted to mitigate PID reuse attacks by passing trusted UIDs from SO_PEERCRED receive no protection due to this bug. The fix (changing uid type from u32 to i32) was merged in version 5.1.0.
Affected products
- zbus_polkit zbus_polkit before 5.1.0
Timeline
- 2026-08-31: disclosed
- 2026-08-30: patched