Every CVE Search/ Get API key

CVE-2011-1485

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows...

6.9 MediumPublic exploitFix available

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.

Exploit likelihood

5.25%Up 3.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.9

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.

Record
CVE-2011-1485
CVSS 2.0
6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-362
Updated
2026-11-02
CVE List No score

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.

Record
CVE-2011-1485
Updated
2026-11-02
EUVDEUVD-2011-1488 No score

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.

Record
EUVD-2011-1488
Updated
2026-11-03
GitHub AdvisoriesGHSA-mjm4-2fq8-2392 No score

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows...

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.

Record
GHSA-mjm4-2fq8-2392
Weakness
CWE-362
Updated
2026-11-02
OSV No score

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.

Record
CVE-2011-1485
Updated
2026-11-02
OSVDEBIAN-CVE-2011-1485 No score

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.

Record
DEBIAN-CVE-2011-1485
Updated
2026-11-02
OSVopenSUSE-SU-2024:10436-1 No score

libpolkit0-0.113-3.4 on GA media

These are all security issues fixed in the libpolkit0-0.113-3.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10436-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
policykit-1
Debian:12
 before 0.101-4
0.101-4
policykit-1
Debian:13
 before 0.101-4
0.101-4
policykit-1
Debian:14
 before 0.101-4
0.101-4
policykit-1
Debian:6.0
 before 0.96-4+squeeze1, plus listed versions
0.96-4
0.96-4+squeeze1
polkit
Red Hat:enterprise_linux:6::client
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-devel
Red Hat:enterprise_linux:6::client
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-docs
Red Hat:enterprise_linux:6::client
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-desktop-policy
Red Hat:enterprise_linux:6::client
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit
Red Hat:enterprise_linux:6::computenode
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
Show 14 moreShow less
Affected packages
PackageAffectedFixed
polkit-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-desktop-policy
Red Hat:enterprise_linux:6::computenode
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-devel
Red Hat:enterprise_linux:6::computenode
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-docs
Red Hat:enterprise_linux:6::computenode
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit
Red Hat:enterprise_linux:6::server
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-desktop-policy
Red Hat:enterprise_linux:6::server
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-devel
Red Hat:enterprise_linux:6::server
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-docs
Red Hat:enterprise_linux:6::server
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit
Red Hat:enterprise_linux:6::workstation
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-desktop-policy
Red Hat:enterprise_linux:6::workstation
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-devel
Red Hat:enterprise_linux:6::workstation
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1
polkit-docs
Red Hat:enterprise_linux:6::workstation
 before 0:0.96-2.el6_0.1
0:0.96-2.el6_0.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPolicyKit polkit-1 < 0.101 - Local Privilege Escalation2011-10-05
Exploit-DBpkexec - Race Condition Privilege Escalation2011-10-08
Exploit-DBLinux PolicyKit - Race Condition Privilege Escalation (Metasploit)2014-10-20
MetasploitLinux PolicyKit Race Condition Privilege Escalation2011-04-01
PoC in GitHubPashkela/CVE-2011-14852013-06-16
PoC in GitHubbluedragonsecurity/CVE-2011-1485-pkexec-exploit2026-05-14

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-1485 is a medium vulnerability (CVSS 6.9) in Redhat Policykit, published May 31, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.25%, the 92nd percentile. Fixed in policykit-1 0.101-4.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open