Ilya Zlobintsev

**Name of the Vulnerable Software and Affected Versions** zbus polkit versions prior to 5.1.0 **Description** The `Subject::new for owner()` function in the `zbus polkit` crate encodes the `uid` entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), while the `org.freedesktop.PolicyKit1.Authority` interface expects a signed 32-bit integer (D-Bus type i). This type mismatch causes polkit to discard the supplied `uid` and instead determine the subject's owner by looking up the PID in `/proc`. This process is susceptible to a time-of-check/time-of-use (TOCTOU) race, where a local unprivileged attacker can exploit PID reuse. If an attacker can cause an authorized process to terminate and obtain the same PID, they may be authorized under the identity of the terminated process, bypassing authorization checks. **Recommendations** Update to version 5.1.0 or later.