CVE-2013-4327: Race Condition
Sebastian Krahmer reported a security issue was found in polkit (CVE-2013-4288 bz 1002375).
It was found that systemd was vulnerable to this issue as well, since it communicated to polkit authority using an unsafe DBUS interface.
This issue has been assigned CVE-2013-4327
Other sources
systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4327?
CVE-2013-4327 is considered a moderate severity vulnerability.
How do I fix CVE-2013-4327?
To fix CVE-2013-4327, upgrade polkit to a version that has the vulnerability patched.
What systems are affected by CVE-2013-4327?
CVE-2013-4327 affects versions of systemd up to 207, Debian Linux 7.0, and Ubuntu Linux 13.04.
What type of vulnerability is CVE-2013-4327?
CVE-2013-4327 is a security vulnerability found in polkit affecting privilege escalation.
Who reported CVE-2013-4327?
CVE-2013-4327 was reported by Sebastian Krahmer.