Code: get_caller_uid (GDBusMethodInvocation *context, gint *uid)
 {
        PolkitSubject *subject;
        PolkitSubject *process;
 
        subject = polkit_system_bus_name_new (g_dbus_method_invocation_get_sender (context));
        process = polkit_system_bus_name_get_process_sync (POLKIT_SYSTEM_BUS_NAME (subject), NULL, NULL);
        if (!process) {
                g_object_unref (subject);
                 return FALSE;
         }
 
        *uid = polkit_unix_process_get_uid (POLKIT_UNIX_PROCESS (process));
        g_object_unref (subject);
        g_object_unref (process);
 
         return TRUE;
 }

Vulnerability Type: 
CWE ID: CWE-362
Summary: The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
Commit Message: 