CVE-2021-3560 is memorable because the failure is small and the consequence is large. A local, unprivileged request should carry a caller identity into a privileged policy decision. In the vulnerable path, an interrupted D-Bus lookup is mishandled and Polkit treats the missing identity as UID 0. The correct engineering response is not clever timing. It is refusing to authorise when identity evidence disappears.
01 · Scope the local boundary
The room is an authorised Ubuntu 20.04 lab. Keep the scope precise: your assigned machine, the intended vulnerability, and a learning goal of understanding an authorisation failure. Ubuntu rates it High with CVSS 7.8 and records low privileges required, no user interaction and high confidentiality, integrity and availability impact. That severity does not turn every Polkit service into a valid target.
Start with a five-part loop: observe the package state, form a version hypothesis, read the service relationship, use only the room's intended safe validation, then update your model. Do not scan other hosts, copy room credentials, retain dynamic flags or transfer a lab sequence to a real system.
02 · Model the identity request
Polkit is a fine-grained Linux authorisation service. When a process requests a privileged action, Polkit must determine who requested it and which policy applies. D-Bus brokers communication between local processes. That makes the identity lookup part of the security boundary, not plumbing to ignore.
| Component | Role | Security question |
|---|---|---|
| Unprivileged process | Requests an action. | Which local principal initiated it? |
| D-Bus broker | Connects request and identity lookup. | Is the request reference still valid? |
| Polkit | Applies authorisation policy. | Does uncertainty deny the action? |
| Privileged service | Performs the state change. | Did it receive an approved, attributable request? |
In the vulnerable implementation, an interruption can remove the request reference before the identity lookup completes. The downstream error is then interpreted as UID 0. The core lesson is architectural: an error from an identity system is evidence of uncertainty, never evidence of root.
03 · Read the patch evidence
Version evidence creates a hypothesis, not a conclusion. The TryHackMe room uses Ubuntu 20.04 and identifies the patched Focal package as 0.105-26ubuntu1.1. Canonical's advisory confirms that fixed version and explains that the issue could let an unprivileged local attacker bypass credential checks for D-Bus requests.
dpkg-query -W -f='${Package} ${Version}\n' policykit-1
apt-cache policy policykit-1
systemctl status polkit --no-pagerRun these only on your authorised lab machine or systems you administer. Package version says whether the known Ubuntu fix is present. Repository policy shows whether a patched candidate is available. Service status tells you whether the authorisation component is running. None proves a live exploitability result in another distribution, container image or custom build.
04 · Validate the lesson safely
The room demonstrates the vulnerability in its own disposable environment. Keep public notes spoiler-aware: do not publish the race timing, account-creation request, password material, dynamic flag or a script that automates the path. Those are perishable room answers, not transferable understanding.
Instead, validate a harmless claim: which identity does the lab process have, what does the patched version look like, and does a denied privileged request remain denied after the fix? The evidence to preserve is a sanitised package version, service state, policy decision and audit trace. If a result depends on an exact timing window, record that instability as a limitation, not as a challenge to brute-force.
05 · Repair and detect
Canonical's fixed package for Ubuntu 20.04 is 0.105-26ubuntu1.1; supported Ubuntu releases have their own fixed versions. Patch through the normal supported update process, verify the installed version after the change, and include golden images and templates in the same review. A host patched today can be rebuilt tomorrow from an old image.
| Failure point | Durable control |
|---|---|
| Vulnerable package remains deployed. | Patch management and image baselines. |
| Local users gain an unnecessary foothold. | Least privilege and endpoint hardening. |
| Authorisation anomalies go unnoticed. | Forward Polkit, D-Bus and account-management logs. |
| Legacy images return. | Block vulnerable versions at build and deployment gates. |
The reliable detection question is not “did a magic string appear?” It is “did an account, group membership or privileged service action occur without an accountable authorised caller?” Pair system authentication logs with account-management and package telemetry. Then investigate the process tree and D-Bus context under your incident process.
What the chain teaches
A request lifecycle crossed several trust boundaries: an unprivileged caller, a brokered message, an identity lookup, a policy decision and a privileged action. The design failed because uncertainty at one boundary was converted into the most privileged identity at the next. That pattern transfers to service meshes, cloud identity resolvers, workflow engines and AI agents that translate untrusted context into tool authority.
Memory aid: identity, policy, action. When a privileged action is allowed, be able to point to all three. If identity is unknown, policy evaluation should stop before the action is reached.
Frequently asked questions
Why is CVE-2021-3560 described as a fail-open failure?
An interrupted D-Bus request made the identity lookup fail, and the vulnerable logic treated the missing identity as UID 0. Uncertainty was converted into the most privileged identity.
What is the one rule to remember?
Identity, policy, action. When a privileged action is allowed, be able to point to all three. If identity is unknown, policy evaluation should stop before the action.
How should a team detect this class of issue?
Ask whether an account, group membership or privileged service action occurred without an accountable authorised caller, and pair authentication logs with account and package telemetry.
Primary references and further practice
- TryHackMe: Polkit official room
- Canonical: CVE-2021-3560 advisory
- CVE record: CVE-2021-3560
- For another authority-boundary companion, read Alfred: Jenkins Authority to System or browse all authorised writeups.