Local Access Bypass Vulnerability in KDE kdelibs and kauth Products

CVE-2014-5033

Summary

KDE's kdelibs prior to version 4.14 and kauth before version 5.1 contain a vulnerability where proper D-Bus communication with a polkit authority is not enforced. This flaw creates a race condition involving PolkitUnixProcess PolkitSubject, permitting local users to potentially bypass intended access controls. The issue can be exploited via a setuid process or a pkexec command, which may allow malicious actors to exploit system privileges incorrectly.

References