CVE-2019-6133

Description

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

CVSS Version 3.0

nvd

CVE ID: CVE-2019-6133
Base Score: 6.7
Base Severity: MEDIUM
Vector String:CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

CVSS Version 2.0

nvd

CVE ID: CVE-2019-6133
Base Score: 4.4
Base Severity: MEDIUM
Vector String:AV:L/AC:M/Au:N/C:P/I:P/A:P

Refrence: NVD