Actively exploited · Published Jan 28, 2022 · Assigned by redhat
CVE-2021-4034
High 7.8 Exploited Ransomware
In plain English
A high-severity out-of-bounds write in polkit. Attackers are actively exploiting it in the wild (listed by CISA on June 27, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 94.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jul 18, 2022.
Official description
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | polkit | 0.115-13.el8_5.2 | ALSA-2022:0267 |
| AlmaLinux:8 | polkit-devel | 0.115-13.el8_5.2 | ALSA-2022:0267 |
| AlmaLinux:8 | polkit-docs | 0.115-13.el8_5.2 | ALSA-2022:0267 |
| AlmaLinux:8 | polkit-libs | 0.115-13.el8_5.2 | ALSA-2022:0267 |
| Alpine:v3.20 | polkit | 0.120-r2 | ALPINE-CVE-2021-4034 |
| Alpine:v3.21 | polkit | 0.120-r2 | ALPINE-CVE-2021-4034 |
| Alpine:v3.22 | polkit | 0.120-r2 | ALPINE-CVE-2021-4034 |
| Alpine:v3.23 | polkit | 0.120-r2 | ALPINE-CVE-2021-4034 |
| Alpine:v3.24 | polkit | 0.120-r2 | ALPINE-CVE-2021-4034 |
| Debian:12 | policykit-1 | 0.105-31.1 | DEBIAN-CVE-2021-4034 |
| Debian:13 | policykit-1 | 0.105-31.1 | DEBIAN-CVE-2021-4034 |
| Debian:14 | policykit-1 | 0.105-31.1 | DEBIAN-CVE-2021-4034 |
| Rocky Linux:8 | polkit | 0:0.115-13.el8_5.1 | RLSA-2022:0267 |
| Ubuntu:22.04:LTS | policykit-1 | 0.105-31ubuntu1 | UBUNTU-CVE-2021-4034 |
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://access.redhat.com/security/vulnerabilities/RHSB-2022-001
- https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
- https://bugzilla.redhat.com/show_bug.cgi?id=2025869
- https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683
- https://www.oracle.com/security-alerts/cpuapr2022.html
- http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html
- https://www.suse.com/support/kb/doc/?id=000020564
- https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf
- https://www.starwindsoftware.com/security/sw-20220818-0001/
- https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/
- https://www.vicarius.io/vsociety/posts/pwnkit-pkexec-lpe-cve-2021-4034
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-4034 government-resource