[Bug 1986913] Re: privilege escallation

[Curtis Gedak]

A disk partitioning and formatting tool, such as GParted, requires root
privilege to be able to create new partition tables, format disks and
partitions, update the Linux kernel with the changes, etc.  By its very
nature GParted can completely overwrite everything on a disk device.

With this in mind, why is the ability to overwrite a file considered a
security concern when GParted could be used to change the entire
contents of the disk device?

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to gparted in Ubuntu.
https://bugs.launchpad.net/bugs/1986913

Title:
  privilege escallation

Status in gparted package in Ubuntu:
  Invalid

Bug description:
  Hi :-)

  I have (maybe) found a privilege escalation in gparted (GParted 1.3.1)

  A user with unprivileged rights was granted with standard polkit rules access to gparted.
  Once the user correctly authenticates the gparted gui loads, and the user can partition any attached device (that is ok!)

  BUT once done, the user is presented with the summary AND there one has the option to 
  ----> SAVE DETAILS <---- (gparted-2-issue.png)

  That is a BIG problem! 
  One can overwrite virtually any file on the system (being root) with the gparted output!

  Could you advise me on this matter?

  Thank you very much!
  Kind regards
  Otto

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gparted/+bug/1986913/+subscriptions