⬇ Download holy card: ·
⚔ Commemorated today: The Great Plague of Slammer (2003)Saint PwnKit, Who Gave Root to Passers-by
Patron of setuid programs, people who count arguments starting from one, and bugs that wait twelve years.
Life
On 25 January 2022 Qualys revealed that pkexec, part of polkit and present in almost every Linux distribution, got confused when launched without a single argument. Reading past the end of the list, it mistook environment variables for arguments and handed root privileges to any local user. The flaw had been there since 2009.
Prayer
O Saint PwnKit, who gave root to anyone with nothing to say, teach our setuid programs to check argc. Amen.
How to celebrate
Celebrated by updating polkit or, for the hastiest devotees, removing the setuid bit from pkexec.
Say nothing, and sometimes you get everything.