CVE-2013-4288
Fixed in a distro release EPSS <1%
Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.
Products: opensuse, polkit_project polkit, canonical ubuntu_linux, redhat enterprise_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | policykit-1 | 0.105-3+nmu1 |
| Debian 13 | policykit-1 | 0.105-3+nmu1 |
| Debian 14 | policykit-1 | 0.105-3+nmu1 |
| Red Hat Enterprise Linux 6 | polkit | 0:0.96-5.el6_4 |
| Red Hat Enterprise Linux 6 | polkit-debuginfo | 0:0.96-5.el6_4 |
| Red Hat Enterprise Linux 6 | polkit-desktop-policy | 0:0.96-5.el6_4 |
| Red Hat Enterprise Linux 6 | polkit-devel | 0:0.96-5.el6_4 |
| Red Hat Enterprise Linux 6 | polkit-docs | 0:0.96-5.el6_4 |
| openSUSE Tumbleweed | systemd | 228-17.1 |