CVE-2014-5033

2014-08-1918:55:00

CWE-362

[email protected]

web.nvd.nist.gov

cve-2014-5033

kde

kdelibs

kauth

polkit authority

d-bus

access restrictions

race condition

pid reuse

8.4 High

AI Score

Confidence

High

6.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.3%

JSON

KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and “PID reuse race conditions.”

CPENameOperatorVersion
debian:kde4libsdebian kde4libseq-
canonical:ubuntu_linuxcanonical ubuntu linuxeq14.04
canonical:ubuntu_linuxcanonical ubuntu linuxeq12.04
kde:kdelibskde kdelibseq4.13.90
kde:kdelibskde kdelibsle4.13.97
kde:kdelibskde kdelibseq4.11.4
kde:kdelibskde kdelibseq4.10.97
kde:kdelibskde kdelibseq4.12.3
kde:kdelibskde kdelibseq4.10.2
kde:kdelibskde kdelibseq4.12.1

CPE	Name	Operator	Version
debian:kde4libs	debian kde4libs	eq	-
canonical:ubuntu_linux	canonical ubuntu linux	eq	14.04
canonical:ubuntu_linux	canonical ubuntu linux	eq	12.04
kde:kdelibs	kde kdelibs	eq	4.13.90
kde:kdelibs	kde kdelibs	le	4.13.97
kde:kdelibs	kde kdelibs	eq	4.11.4
kde:kdelibs	kde kdelibs	eq	4.10.97
kde:kdelibs	kde kdelibs	eq	4.12.3
kde:kdelibs	kde kdelibs	eq	4.10.2
kde:kdelibs	kde kdelibs	eq	4.12.1