CVE-2013-4327: canonical ubuntu_linux Race Condition

Vulnerability summary

CVE-2013-4327 is a medium (CVSS 6.9) Race Condition vulnerability in canonical ubuntu_linux. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.3% of scored vulnerabilities.

Timeline

1. 03-10-2013
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.