Skip to main content
View

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS score of 6.7 (MEDIUM). Attack characteristics: local attack vector, high complexity, low privileges required, user interaction required.
Exploit ScenarioDerived

Successful exploitation could compromise the medium-severity affected system.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. Rated medium severity (CVSS 6.7).

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-362. In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c. Affected products include: Polkit Project Polkit, Debian Debian Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus.

Know when Polkit gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.7 MEDIUM
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionNVD

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

Threat Intelligence Overview

EPSS Score
0.4%
Top 64% exploitable
Data Quality
2 sources
Confidence: Low
NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

34
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +34
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Affected Products (CPE)NVD

cpe:2.3:a:polkit_project:polkit:0.115:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

More in Polkit

View all
CVE-2018-19788 HIGH POC
8.8 Dec 03

A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully exec
CVE-2016-2568 HIGH
7.8 Feb 13

pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl ca
CVE-2013-4288 HIGH
7.2 Oct 03

Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privilege
CVE-2026-4897 MEDIUM
5.5 Mar 26

Polkit's polkit-agent-helper-1 setuid binary fails to bound input length on stdin, allowing local authenticated users to
CVE-2015-3255 MEDIUM
4.6 Oct 26

The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before
CVE-2015-4625 MEDIUM
4.6 Oct 26

Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local use
CVE-2015-3256 MEDIUM
4.6 Oct 26

PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemo
CVE-2018-1116 MEDIUM
4.4 Jul 10

A flaw was found in polkit before version 0.116. Rated medium severity (CVSS 4.4), this vulnerability is low attack comp
CVE-2015-3218 LOW
2.1 Oct 26

The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) bef

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

References

Advisories & patches
PATCH https://git.kernel.org/linus/7b55851367136b1efd84d98fea81ba57a98304cf PATCH https://gitlab.freedesktop.org/polkit/polkit/commit/c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81 PATCH https://gitlab.freedesktop.org/polkit/polkit/merge_requests/19 REF http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00049.html REF http://www.securityfocus.com/bid/106537 REF https://access.redhat.com/errata/RHSA-2019:0230 REF https://access.redhat.com/errata/RHSA-2019:0420 REF https://access.redhat.com/errata/RHSA-2019:0832 REF https://access.redhat.com/errata/RHSA-2019:2699 REF https://access.redhat.com/errata/RHSA-2019:2978 REF https://bugs.chromium.org/p/project-zero/issues/detail?id=1692 REF https://lists.debian.org/debian-lts-announce/2019/01/msg00021.html REF https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html REF https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html REF https://support.f5.com/csp/article/K22715344 REF https://usn.ubuntu.com/3901-1/ REF https://usn.ubuntu.com/3901-2/ REF https://usn.ubuntu.com/3903-1/ REF https://usn.ubuntu.com/3903-2/ REF https://usn.ubuntu.com/3908-1/ REF https://usn.ubuntu.com/3908-2/ REF https://usn.ubuntu.com/3910-1/ REF https://usn.ubuntu.com/3910-2/ REF https://usn.ubuntu.com/3934-1/ REF https://usn.ubuntu.com/3934-2/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy