Every CVE Search/ Get API key

CVE-2013-4326

RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority...

4.6 MediumFix available

RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Exploit likelihood

0.37%Down 0.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.6

RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Record
CVE-2013-4326
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Record
CVE-2013-4326
Updated
2026-11-02
EUVDEUVD-2013-4213 No score

RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Record
EUVD-2013-4213
Updated
2026-11-03
GitHub AdvisoriesGHSA-63rr-v2vx-w3jw No score

RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority...

RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Record
GHSA-63rr-v2vx-w3jw
Updated
2026-11-02
OSV No score

RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Record
CVE-2013-4326
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4326 No score

RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Record
DEBIAN-CVE-2013-4326
Updated
2026-11-02
OSVMGASA-2013-0293 No score

Updated polkit package and the packages that call polkit fixes security vulnerability

A race condition was found in the way the PolicyKit pkcheck utility checked process authorization when the process was specified by its process ID via the --process option. A local user could use this flaw to bypass intended PolicyKit authorizations and escalate their privileges (CVE-2013-4288).

Note: Applications that invoke pkcheck with the --process option need to be modified to use the pid,pid-start-time,uid argument for that option, to allow pkcheck to check process authorization correctly.

Because of the change in the PolicyKit API, the spice-gtk (CVE-2013-4324), hplip (CVE-2013-4325), rtkit (CVE-2013-4326), and systemd (CVE-2013-4327) packages have been updated to use a different API that is not affected by this PolicyKit vulnerability. The libvirt package will also be updated for the same reason, but this update will come in a separate advisory.

Record
MGASA-2013-0293
Updated
2026-11-02
OSVopenSUSE-SU-2024:10557-1 No score

rtkit-0.11+git.20130926-3.1 on GA media

These are all security issues fixed in the rtkit-0.11+git.20130926-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10557-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rtkit
Debian:12
 before 0.10-3
0.10-3
rtkit
Debian:13
 before 0.10-3
0.10-3
rtkit
Debian:14
 before 0.10-3
0.10-3
polkit
Mageia:2
From an advisory covering 5 CVEs
 before 0.104-4.2.mga2
0.104-4.2.mga2
spice-gtk
Mageia:2
From an advisory covering 5 CVEs
 before 0.9-1.2.mga2
0.9-1.2.mga2
hplip
Mageia:2
From an advisory covering 5 CVEs
 before 3.12.4-1.3.mga2
3.12.4-1.3.mga2
rtkit
Mageia:2
From an advisory covering 5 CVEs
 before 0.10-3.1.mga2
0.10-3.1.mga2
systemd
Mageia:2
From an advisory covering 5 CVEs
 before 44-13.1.mga2
44-13.1.mga2
polkit
Mageia:3
From an advisory covering 5 CVEs
 before 0.107-6.1.mga3
0.107-6.1.mga3
spice-gtk
Mageia:3
From an advisory covering 5 CVEs
 before 0.15-3.1.mga3
0.15-3.1.mga3
Show 12 moreShow less
Affected packages
PackageAffectedFixed
hplip
Mageia:3
From an advisory covering 5 CVEs
 before 3.12.9-6.1.mga3
3.12.9-6.1.mga3
rtkit
Mageia:3
From an advisory covering 5 CVEs
 before 0.11-3.1.mga3
0.11-3.1.mga3
systemd
Mageia:3
From an advisory covering 5 CVEs
 before 195-22.1.mga3
195-22.1.mga3
rtkit
Red Hat:enterprise_linux:6::client
 before 0:0.5-2.el6_4
0:0.5-2.el6_4
rtkit-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:0.5-2.el6_4
0:0.5-2.el6_4
rtkit
Red Hat:enterprise_linux:6::computenode
 before 0:0.5-2.el6_4
0:0.5-2.el6_4
rtkit-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:0.5-2.el6_4
0:0.5-2.el6_4
rtkit
Red Hat:enterprise_linux:6::server
 before 0:0.5-2.el6_4
0:0.5-2.el6_4
rtkit-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:0.5-2.el6_4
0:0.5-2.el6_4
rtkit
Red Hat:enterprise_linux:6::workstation
 before 0:0.5-2.el6_4
0:0.5-2.el6_4
rtkit-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:0.5-2.el6_4
0:0.5-2.el6_4
rtkit
openSUSE:Tumbleweed
 before 0.11+git.20130926-3.1
0.11+git.20130926-3.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4326 is a medium vulnerability (CVSS 4.6) in Lennart Poettering Rkit, published October 3, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in rtkit 0.10-3.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open