polkit: out-of-bounds write parsing deeply nested XML policy files

Impact

polkit's XML policy parser writes out of bounds when a .policy file nests 32 or more elements. The result is at least a crash of the policy engine and, per Red Hat, arbitrary code execution is not ruled out. polkit is the authorisation broker behind systemd, NetworkManager and container tooling on every RHEL-family GPU node, so a crash there breaks privileged operations an operator relies on during maintenance. The saving grace is the precondition: an attacker already needs a high-privilege account to drop a policy file into a directory polkit reads, so this is a privilege-escalation-completion or persistence step rather than an initial foothold. Treat it as hardening on shared bastion and management hosts rather than a tenant-facing hole.

Who can reach it

Local, and requires an already high-privilege account - the attacker must be able to place a malicious .policy file in a polkit policy directory. No network or tenant-pod reachability.

What to do

Apply the distribution polkit update (Red Hat has errata for RHEL 6-10 and OpenShift Container Platform 4); upstream fix is polkit commit 107d3801361b9f9084f78710178e683391f1d245. polkitd is restarted by the package update, so this is a package upgrade plus daemon restart - no reboot and no node drain needed.

References