Log in Start free

Actively exploited · Published Feb 16, 2022 · Assigned by redhat

CVE-2021-3560

High 7.8 Exploited

In plain English

A high-severity incorrect authorization in polkit. Attackers are actively exploiting it in the wild (listed by CISA on May 12, 2023). The chance it is exploited in the next 30 days is estimated at 22.2% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)22.2%top 2.3% of all CVEs
Exploited in the wildYesCISA KEV since May 12, 2023
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 2, 2023.

Official description

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20polkit0.119-r0ALPINE-CVE-2021-3560
Alpine:v3.21polkit0.119-r0ALPINE-CVE-2021-3560
Alpine:v3.22polkit0.119-r0ALPINE-CVE-2021-3560
Alpine:v3.23polkit0.119-r0ALPINE-CVE-2021-3560
Alpine:v3.24polkit0.119-r0ALPINE-CVE-2021-3560
Debian:12policykit-10.105-31DEBIAN-CVE-2021-3560
Debian:13policykit-10.105-31DEBIAN-CVE-2021-3560
Debian:14policykit-10.105-31DEBIAN-CVE-2021-3560
Rocky Linux:8polkit0:0.115-11.el8_4.1RLSA-2021:2238
Ubuntu:22.04:LTSpolicykit-10.105-31UBUNTU-CVE-2021-3560

Affected products (as reported)

VendorProductVersions
n/a polkit polkit 0.119

Weakness: CWE-863 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References