CVE-2013-4288: Canonical Ubuntu Linux

High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days.

Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.

Affected products

• Canonical Ubuntu Linux: version 10.04 only; version 12.04 only; version 12.10 only; version 13.04 only
• Opensuse Opensuse: version 12.2 only; version 12.3 only
• Polkit Project Polkit: before 0.112.1 (fixed in 0.112.1)
• Red Hat Enterprise Linux: version 6.0 only

Published 2013-10-03. Last modified 2026-06-16.