CVEs-PoC/2013/CVE-2013-4288.md

### [CVE-2013-4288](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4288)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)

### Description

Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.

### POC

#### Reference
- http://seclists.org/oss-sec/2013/q3/626
- http://www.openwall.com/lists/oss-security/2013/09/18/4

#### Github
- https://github.com/c-skills/CVEs