A privilege escalation vulnerability was found in polkit. Polkit stores rules in /etc/polkit-1/rules.d. We follow the upstream provided permissions for this folder, so polkitd owns it and permissions are set to 700. Since the user owns the directory it's easy to escalate from user polkitd to root. The user can create own rules that are interpreted by the polkit authority which in turn grants root privileges via e.g. the setuid root binary pkexec.