CVE-2013-4327
systemd does not properly use D-Bus for communication with a polkit authority, which allows local...
systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Exploit likelihood
What each source reports
NVD Score used
systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
- Record
CVE-2013-4327- CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
- Record
CVE-2013-4327- Updated
- 2026-11-02
EUVDEUVD-2013-4214 No score
systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
- Record
EUVD-2013-4214- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v982-v47w-8j5p No score
systemd does not properly use D-Bus for communication with a polkit authority, which allows local...
systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
- Record
GHSA-v982-v47w-8j5p- Weakness
- CWE-362
- Updated
- 2026-11-02
OSV No score
systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
- Record
CVE-2013-4327- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4327 No score
systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
- Record
DEBIAN-CVE-2013-4327- Updated
- 2026-11-02
OSVMGASA-2013-0293 No score
Updated polkit package and the packages that call polkit fixes security vulnerability
A race condition was found in the way the PolicyKit pkcheck utility checked process authorization when the process was specified by its process ID via the --process option. A local user could use this flaw to bypass intended PolicyKit authorizations and escalate their privileges (CVE-2013-4288).
Note: Applications that invoke pkcheck with the --process option need to be modified to use the pid,pid-start-time,uid argument for that option, to allow pkcheck to check process authorization correctly.
Because of the change in the PolicyKit API, the spice-gtk (CVE-2013-4324), hplip (CVE-2013-4325), rtkit (CVE-2013-4326), and systemd (CVE-2013-4327) packages have been updated to use a different API that is not affected by this PolicyKit vulnerability. The libvirt package will also be updated for the same reason, but this update will come in a separate advisory.
- Record
MGASA-2013-0293- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
systemdDebian:12 |
before 204-5 | 204-5 |
systemdDebian:13 |
before 204-5 | 204-5 |
systemdDebian:14 |
before 204-5 | 204-5 |
systemdDebian:7 From an advisory covering 3 CVEs |
before 44-11+deb7u4, plus listed versions 44-1144-11+deb7u144-11+deb7u244-11+deb7u3 |
44-11+deb7u4 |
polkitMageia:2 From an advisory covering 5 CVEs |
before 0.104-4.2.mga2 | 0.104-4.2.mga2 |
spice-gtkMageia:2 From an advisory covering 5 CVEs |
before 0.9-1.2.mga2 | 0.9-1.2.mga2 |
hplipMageia:2 From an advisory covering 5 CVEs |
before 3.12.4-1.3.mga2 | 3.12.4-1.3.mga2 |
rtkitMageia:2 From an advisory covering 5 CVEs |
before 0.10-3.1.mga2 | 0.10-3.1.mga2 |
systemdMageia:2 From an advisory covering 5 CVEs |
before 44-13.1.mga2 | 44-13.1.mga2 |
polkitMageia:3 From an advisory covering 5 CVEs |
before 0.107-6.1.mga3 | 0.107-6.1.mga3 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
spice-gtkMageia:3 From an advisory covering 5 CVEs |
before 0.15-3.1.mga3 | 0.15-3.1.mga3 |
hplipMageia:3 From an advisory covering 5 CVEs |
before 3.12.9-6.1.mga3 | 3.12.9-6.1.mga3 |
rtkitMageia:3 From an advisory covering 5 CVEs |
before 0.11-3.1.mga3 | 0.11-3.1.mga3 |
systemdMageia:3 From an advisory covering 5 CVEs |
before 195-22.1.mga3 | 195-22.1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4327 is a medium vulnerability (CVSS 6.9) in Systemd Project Systemd, published October 3, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in systemd 204-5.
References
ubuntu.com/usn/USN-1961-1
openwall.com/lists/oss-security/2013/09/18/6
debian.org/security/2013/dsa-2777
bugzilla.redhat.com/show_bug.cgi?id=1006680
nvd.nist.gov/vuln/detail/CVE-2013-4327
github.com/advisories/GHSA-v982-v47w-8j5p
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2013-4327
advisories.mageia.org/MGASA-2013-0293.html
bugs.mageia.org/show_bug.cgi?id=11260
rhn.redhat.com/errata/RHSA-2013-1270.html