Vulnerability Details : CVE-2013-4327
systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Products affected by CVE-2013-4327
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*
- cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-4327
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 10 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-4327
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.9
|
MEDIUM | AV:L/AC:M/Au:N/C:C/I:C/A:C |
3.4
|
10.0
|
NIST |
CWE ids for CVE-2013-4327
-
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-4327
-
https://bugzilla.redhat.com/show_bug.cgi?id=1006680
1006680 – (CVE-2013-4327) CVE-2013-4327 systemd: insecure calling of polkitIssue Tracking;Patch;Third Party Advisory
-
http://www.debian.org/security/2013/dsa-2777
Debian -- Security Information -- DSA-2777-1 systemdThird Party Advisory
-
http://www.openwall.com/lists/oss-security/2013/09/18/6
oss-security - Re: Fwd: [vs-plain] polkit racesMailing List;Third Party Advisory
-
http://www.ubuntu.com/usn/USN-1961-1
USN-1961-1: systemd vulnerability | Ubuntu security noticesVendor Advisory
Jump to