Description
Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | policykit-1 | 0.101-4 | — |
| Debian 13 | policykit-1 | 0.101-4 | — |
| Debian 12 | policykit-1 | 0.101-4 | — |
| Debian 6.0 | policykit-1 | 0.96-4+squeeze1 | DSA-2319-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | polkit +3 | 0.96-2.el6_0.1 | RHSA-2011:0455 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Linux PolicyKit Race Condition Privilege Escalation
exploit/linux/local/pkexec
Exploit-DB 3
- Linux PolicyKit - Race Condition Privilege Escalation (Metasploit) EDB-35021 · local · Oct 20, 2014 · verified
- pkexec - Race Condition Privilege Escalation EDB-17942 · local · Oct 8, 2011
- PolicyKit polkit-1 < 0.101 - Local Privilege Escalation EDB-17932 · local · Oct 5, 2011
GitHub 2 repositories
-
bluedragonsecurity/CVE-2011-1485-pkexec-exploit ★ 1 · May 14, 2026
CVE-2011-1485 - Linux pkexec and polkitd 0.96 race condition privilege escalation exploit. Developed in 2011 by Antonius (ev1lut10n / w1sdom)
-
Pashkela/CVE-2011-1485 ★ 0 · Jun 16, 2013
CVE-2011-1485 - Published: 2011-04-01 - PolicyKit:
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2011:0455 Red Hat Security Advisory: polkit security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2319-1 policykit-1 - race condition Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2011:0455 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=692922
- DSA-2319 vendor-advisory
- 8424 third-party-advisory
- FEDORA-2011-5676 vendor-advisory
- USN-1117-1 vendor-advisory
- FEDORA-2011-5589 vendor-advisory
- GLSA-201204-06 vendor-advisory
- 48817 third-party-advisory
- MDVSA-2011:086 vendor-advisory