一、 漏洞 CVE-2025-14338 基础信息

                                        # Polkit 输入插管默认认证禁用漏洞

## 概述
Polkit 在版本 v0.69.0 之前存在一个授权检查的竞争条件漏洞，且默认禁用身份验证，可导致与 CVE-2025-66005 相同的安全问题。

## 影响版本
Polkit 版本早于 v0.69.0。

## 细节
该漏洞源于 Polkit 授权机制中的竞争条件，当身份验证默认处于禁用状态时，攻击者可利用此竞争条件绕过正常的权限检查。

## 影响
攻击者可能利用该漏洞绕过权限控制，实现本地权限提升，获得未授权的操作权限。
                                        

二、漏洞 CVE-2025-14338 的公开POC

三、漏洞 CVE-2025-14338 的情报信息

• 标题： 1249149 – (CVE-2025-14338, CVE-2025-66005) AUDIT-TRACKER: CVE-2025-14338,CVE-2025-66005: inputplumber: dbus-file-unauthorized -- 🔗来源链接

  标签：

  神龙速读：

                                          - **Bug ID:** 1249149
  - **Summary:** AUDIT-TRACKER: CVE-2025-14338, CVE-2025-66005: inputplumber: dbus-file-unauthorized
  - **Status:** IN_PROGRESS
  - **Product:** openSUSE Tumbleweed
  - **Component:** Security
  - **Version:** Current
  - **Severity:** Normal
  - **Classification:** openSUSE
  - **Alias:** CVE-2025-14338, CVE-2025-66005
  - **Reported:** 2025-09-05 00:09 UTC by Tobias Görgens
  - **Modified:** 2026-01-19 22:16 UTC
  - **Assignee:** Matthias Gerstner
  
  **Key Points:**
  - The vulnerability relates to the InputPlumber package's D-Bus interface being unauthorized.
  - It involves lack of default-enabled Polkit authentication and a race condition in Polkit authorization.
  - Fixes are being coordinated upstream with Pull Requests to address various aspects of the report.
  - CVSS scores indicate a high severity due to the potential for arbitrary code execution or a local root exploit.
  - The embargo period has been lifted, and release of a new version is pending final testing and review.
                                          

  

• 标题： InputPlumber: Lack of D-Bus Authorization and Input Verification allows UI Input Injection and Denial-of-Service (CVE-2025-66005, CVE-2025-14338) | SUSE Security Team Blog -- 🔗来源链接

  标签：

  神龙速读：

                                          - **CVEs**: CVE-2025-66005, CVE-2025-14338
  - **Vulnerable Component**: InputPlumber, a Linux utility part of SteamOS
  - **Affected Version**: 0.67.0 (and earlier)
  - **Vulnerabilities**:
    - **Lack of Authentication/Polkit Authentication Bypass**: Client authentication was either missing or bypassed, allowing unprivileged users to access D-Bus methods without authentication.
    - **D-Bus Methods Allowing Privilege Escalation**:
      - `CreateCompositeDevice` and `CreateTargetDevice` methods allow unauthorized access and privilege escalation.
  - **Fixes Suggested and Implemented**:
    - Updated Polkit authentication logic using "system bus name" subject.
    - Enabled Polkit authorization by default in the build process.
    - Used file descriptors instead of path names.
    - Added documentation and systemd service hardening.
  - **Timeline of Disclosure and Fixes**:
    - Initial contact with developers: November 21, 2025.
    - Fixes in InputPlumber version: v0.69.0.
    - Publication of this report: January 9, 2026.
  - **Publication Context**: Some security aspects remained unaddressed at the time of the report's publication.
                                          

  
• https://nvd.nist.gov/vuln/detail/CVE-2025-14338

四、漏洞 CVE-2025-14338 的评论