CVE-2011-1485

Published: May 31, 2011Modified: Apr 29, 2026

6.9

Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 3.4 / Impact: 10.0

Source: NVD

Description

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.

Affected (1)

Products: Redhat: Policykit

Redhat

1 product

Policykit

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Policykit	Version 0.96

Related CWEs

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (20)

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058752.html

Source: secalert@redhat.com

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059859.html

Source: secalert@redhat.com

Patch

http://secunia.com/advisories/48817

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-201204-06.xml

Source: secalert@redhat.com

http://securityreason.com/securityalert/8424

Source: secalert@redhat.com

http://www.debian.org/security/2011/dsa-2319

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2011:086

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-0455.html

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1117-1

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=692922

Source: secalert@redhat.com

Patch

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058752.html