Home

CVE-2013-4288

Description

Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.

Risk Information

Base Score
4.7
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
EPSS Score
Exploitation Probability
0.033

Associated Vulnerability

VulnerabilityOS Platform
(RHSA-2013:1270) Important: polkit security update polkit-0.96-5.el6_4.i686.rpmLinux
(RHSA-2013:1270) Important: polkit security update polkit-0.96-5.el6_4.x86_64.rpmLinux
(RHSA-2013:1270) Important: polkit security update polkit-desktop-policy-0.96-5.el6_4.noarch.rpmLinux
(RHSA-2013:1270) Important: polkit security update polkit-devel-0.96-5.el6_4.i686.rpmLinux
(RHSA-2013:1270) Important: polkit security update polkit-devel-0.96-5.el6_4.x86_64.rpmLinux
(RHSA-2013:1270) Important: polkit security update polkit-docs-0.96-5.el6_4.i686.rpmLinux
(RHSA-2013:1270) Important: polkit security update polkit-docs-0.96-5.el6_4.x86_64.rpmLinux
Polkit update (ELSA-2022-1546) polkit-0.115-13.0.1.el8_5.2.x86_64.rpmLinux
Polkit-devel update (ELSA-2022-1546) polkit-devel-0.115-13.0.1.el8_5.2.i686.rpmLinux
Polkit-devel update (ELSA-2022-1546) polkit-devel-0.115-13.0.1.el8_5.2.x86_64.rpmLinux
Polkit-docs update (ELSA-2022-1546) polkit-docs-0.115-13.0.1.el8_5.2.noarch.rpmLinux
Polkit-libs update (ELSA-2022-1546) polkit-libs-0.115-13.0.1.el8_5.2.i686.rpmLinux
Polkit-libs update (ELSA-2022-1546) polkit-libs-0.115-13.0.1.el8_5.2.x86_64.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234