Fluid Attacks Database

Description

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	policykit-1	>=0 <0.101-4	0.101-4
debian 12	policykit-1	>=0 <0.101-4	0.101-4
debian 14	policykit-1	>=0 <0.101-4	0.101-4
debian 13	policykit-1	>=0 <0.101-4	0.101-4
rpm rhel6	polkit	<0:0.96-2.el6_0.1	0:0.96-2.el6_0.1

Aliases

1. CVE-2011-14852. NVD-2011-14853. OSV-DEBIAN-2011-14854. OSV-2011-14855. SECURITY-TRACKER-CVE-2011-1485

References

1. https://www.exploit-db.com/exploits/350212. https://github.com/Pashkela/CVE-2011-14853. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/pkexec.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.