CVE-2014-5033 Race condition in n/a
Local attackers can exploit a race condition in KDE's D-Bus communication to bypass access restrictions and escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-5033?
CVE-2014-5033 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 19 Aug 2014. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions."
Weakness: CWE-362
Which versions are affected by CVE-2014-5033?
It affects 4 products.
Linux distribution packages (16)
polkit-qt Red Hat:enterprise_linux:7::client | All versions | 0:0.103.0-10.el7_0 |
polkit-qt-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:0.103.0-10.el7_0 |
polkit-qt-devel Red Hat:enterprise_linux:7::client | All versions | 0:0.103.0-10.el7_0 |
polkit-qt-doc Red Hat:enterprise_linux:7::client | All versions | 0:0.103.0-10.el7_0 |
polkit-qt Red Hat:enterprise_linux:7::computenode | All versions | 0:0.103.0-10.el7_0 |
polkit-qt-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:0.103.0-10.el7_0 |
polkit-qt-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:0.103.0-10.el7_0 |
polkit-qt-doc Red Hat:enterprise_linux:7::computenode | All versions | 0:0.103.0-10.el7_0 |
polkit-qt Red Hat:enterprise_linux:7::server | All versions | 0:0.103.0-10.el7_0 |
polkit-qt-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:0.103.0-10.el7_0 |
polkit-qt-devel Red Hat:enterprise_linux:7::server | All versions | 0:0.103.0-10.el7_0 |
polkit-qt-doc Red Hat:enterprise_linux:7::server | All versions | 0:0.103.0-10.el7_0 |
polkit-qt Red Hat:enterprise_linux:7::workstation | All versions | 0:0.103.0-10.el7_0 |
polkit-qt-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:0.103.0-10.el7_0 |
polkit-qt-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:0.103.0-10.el7_0 |
polkit-qt-doc Red Hat:enterprise_linux:7::workstation | All versions | 0:0.103.0-10.el7_0 |
Products include Canonical Ubuntu Linux, Debian Kde4libs, Kde Kauth, Kde Kdelibs.
How do I fix CVE-2014-5033?
Upgrade to a fixed version.
Is CVE-2014-5033 being exploited?
There is no known exploitation of CVE-2014-5033 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DLA-76-1, DSA-3004-1, GHSA-gh63-q3pg-7q7r, MGASA-2014-0327, RHSA-2014:1359, UBUNTU-CVE-2014-5033 and 1 more.