RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

rtkit was fixed to avoid a TOCTOU race condition that might have allowed local attackers to gain realtime rights they should not have.
(CVE-2013-4326)

This update fixes :

  - Bug #1009543 - CVE-2013-4326 rtkit: insecure calling of     polkit [fedora-all]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated polkit packages fix security vulnerability :

A race condition was found in the way the PolicyKit pkcheck utility checked process authorization when the process was specified by its process ID via the --process option. A local user could use this flaw to bypass intended PolicyKit authorizations and escalate their privileges (CVE-2013-4288).

Note: Applications that invoke pkcheck with the --process option need to be modified to use the pid,pid-start-time,uid argument for that option, to allow pkcheck to check process authorization correctly.

Because of the change in the PolicyKit API, hplip (CVE-2013-4325), rtkit (CVE-2013-4326), and systemd (CVE-2013-4327) packages have been updated to use a different API that is not affected by this PolicyKit vulnerability.

It was found that RealtimeKit communicated with PolicyKit for authorization using a D-Bus API that is vulnerable to a race condition. This could have led to intended PolicyKit authorizations being bypassed. This update modifies RealtimeKit to communicate with PolicyKit via a different API that is not vulnerable to the race condition. (CVE-2013-4326)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2013:1282 advisory.

  - rtkit: insecure calling of polkit (CVE-2013-4326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2013:1282 :

An updated rtkit package that fixes one security issue is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

RealtimeKit is a D-Bus system service that changes the scheduling policy of user processes/threads to SCHED_RR (that is, realtime scheduling mode) on request. It is intended to be used as a secure mechanism to allow real-time scheduling to be used by normal user processes.

It was found that RealtimeKit communicated with PolicyKit for authorization using a D-Bus API that is vulnerable to a race condition. This could have led to intended PolicyKit authorizations being bypassed. This update modifies RealtimeKit to communicate with PolicyKit via a different API that is not vulnerable to the race condition. (CVE-2013-4326)

All rtkit users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

An updated rtkit package that fixes one security issue is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

RealtimeKit is a D-Bus system service that changes the scheduling policy of user processes/threads to SCHED_RR (that is, realtime scheduling mode) on request. It is intended to be used as a secure mechanism to allow real-time scheduling to be used by normal user processes.

It was found that RealtimeKit communicated with PolicyKit for authorization using a D-Bus API that is vulnerable to a race condition. This could have led to intended PolicyKit authorizations being bypassed. This update modifies RealtimeKit to communicate with PolicyKit via a different API that is not vulnerable to the race condition. (CVE-2013-4326)

All rtkit users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

It was discovered that RealtimeKit was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75164	openSUSE Security Update : rtkit (openSUSE-SU-2013:1548-1)	Nessus	SuSE Local Security Checks	medium
70407	Fedora 20 : rtkit-0.11-7.fc20 (2013-18442)	Nessus	Fedora Local Security Checks	medium
70358	Fedora 18 : rtkit-0.11-7.fc18 (2013-17583)	Nessus	Fedora Local Security Checks	medium
70185	Mandriva Linux Security Advisory : polkit (MDVSA-2013:243)	Nessus	Mandriva Local Security Checks	high
70159	Fedora 19 : rtkit-0.11-7.fc19 (2013-17529)	Nessus	Fedora Local Security Checks	medium
70115	Scientific Linux Security Update : rtkit on SL6.x i386/x86_64 (20130924)	Nessus	Scientific Linux Local Security Checks	medium
70114	RHEL 6 : rtkit (RHSA-2013:1282)	Nessus	Red Hat Local Security Checks	high
70113	Oracle Linux 6 : rtkit (ELSA-2013-1282)	Nessus	Oracle Linux Local Security Checks	medium
70104	CentOS 6 : rtkit (CESA-2013:1282)	Nessus	CentOS Local Security Checks	medium
69977	Ubuntu 12.04 LTS / 12.10 / 13.04 : rtkit vulnerability (USN-1959-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2013-4326

high

Tenable Plugins

medium

medium

medium

high

medium

medium

high

medium

medium

medium