🟡 Medium | Source: Microsoft Security Response Center
CVE-2016-2568 is a local privilege escalation vulnerability in pkexec, a Linux tool that allows users to run commands as other users. When invoked with the ‘–user nonpriv’ flag, an attacker with local access can escape to the parent session, potentially gaining elevated privileges. Although an older vulnerability, it remains relevant in cloud environments where Linux VMs or containers may run unpatched versions of the polkit package.
Security Architect’s Take: Audit your Azure Linux VM images and container base images for unpatched versions of polkit/pkexec, and ensure your golden images and pipelines enforce up-to-date package versions. If pkexec is not required, consider removing or disabling it as part of your OS hardening baseline.
Original advisory: CVE-2016-2568 pkexec, when used with –user nonpriv, allows local users to escape to the parent session