Vulnerability in Backintime Project
CVE-2017-7572
The _checkPolkitPrivilege function in serviceHelper.py in Back In Time (aka backintime) 1.1.18 and earlier uses a deprecated polkit authorization method (unix-process) that is subject to a race condition (time of check, time of use). With this authorization method, the owner of a process requesting a polkit operation is checked by polkitd via /proc/<pid>/status, by which time the requesting process may have been replaced by a different process with the same PID that has different privileges then the original requester.
Vulnerability class: Race Condition
EPSS: 0.011 (61.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Backintime_project Backintime
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2017-7572?
- CVE-2017-7572 is a high-severity vulnerability in Backintime Project, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 8.1/10. Published 2017-04-06.
- How severe is CVE-2017-7572?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2017-7572 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.