Hacker News Reader

Comment by aftbit | Hacker News Reader

I get:

    [~] compile helper..
    [~] maybe get shell now?
    The value for environment variable XAUTHORITY contains suscipious content
    
    This incident has been reported.

And no root shell

View on HN

Adding `GIO_USE_VFS=` to the end of `a_envp` (starting on line 56), fixes that for me on Fedora 34 with polkit-0.117-3. If anybody knows why that makes a difference, I would love to hear.

Ran into this while writing my exploit. I explain it here https://github.com/v-rzh/CVE-2021-4034/blob/master/README.md... :)

I've just updated my Arch system and tried this. No longer works

Same. Seems like the exploit wouldn't work for me. When I modify the XAUTHORITY line in the code, either to remove it or point it to my current XAUTHORITY value, I rightfully get a GUI password prompt before the root shell will open.

On Arch Linux.

Reply on news.ycombinator.com