CVE-2013-4326Race Condition in Rtkit

9 documents7 sources
Severity
4.6MEDIUMNVD
OSV7.2
EPSS
0.1%
top 80.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedOct 3
Latest updateMay 14

Description

RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages2 packages

debiandebian/rtkit< rtkit 0.10-3 (bookworm)

Also affects: Enterprise Linux 6.0

Patches

🔴Vulnerability Details

2
GHSA
GHSA-63rr-v2vx-w3jw: RealtimeKit (aka rtkit) 02022-05-14
OSV
CVE-2013-4326: RealtimeKit (aka rtkit) 02013-10-03

📋Vendor Advisories

3
Ubuntu
RealtimeKit vulnerability2013-09-18
Red Hat
rtkit: insecure calling of polkit2013-09-18
Debian
CVE-2013-4326: rtkit - RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a...2013

💬Community

3
Bugzilla
CVE-2013-4326 rtkit: insecure calling of polkit [fedora-all]2013-09-18
Bugzilla
CVE-2013-4326 rtkit: insecure calling of polkit2013-09-11
Bugzilla
CVE-2013-4288 polkit: unix-process subject for authorization is racy2013-08-29