Bypass in PolicyKit Authorization Mechanism for Various Linux Distributions
CVE-2019-6133

6.7MEDIUM

Key Information:

Vendor: Polkit Project
Status: Polkit
Vendor: CVE Published:; 11 January 2019

🔔 Create Polkit Project Vulnerability Alert

What is CVE-2019-6133?

In PolicyKit version 0.115, a vulnerability exists that allows attackers to bypass the 'start time' protection mechanism. This issue arises because the fork() function is not atomic, which leads to improper caching of authorization decisions. Additionally, a lack of UID checking in the polkitbackend code exacerbates this vulnerability, potentially allowing unauthorized access to system resources across various Linux distributions.