Vulnerability in Red Hat Policykit
CVE-2011-1485
Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.
Vulnerability class: Race Condition
EPSS: 0.052 (91.7th percentile) — read the EPSS interpretation.
Affected products
- Redhat Policykit — versions 0.96
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Patch)
- secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
- secalert@redhat.com (x_refsource_SREASON, third-party-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA, Patch)
- secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA, Patch)
- secalert@redhat.com (vendor-advisory, x_refsource_GENTOO)
- secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_MANDRIVA)
Frequently asked questions
- What is CVE-2011-1485?
- CVE-2011-1485 is a vulnerability in Red Hat Policykit, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). Published 2011-05-31.
- Is CVE-2011-1485 known to be exploited?
- 14 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.