High [CVE-2021-4034] local privilege escalation vulnerability was found on polkit's pkexec utility
This high-severity Red Hat Linux advisory covers CVE-2021-4034 affecting Red Hat Enterprise Linux 6 Extended Lifecycle Support, Red Hat Enterprise Linux 7.3 Advanced Update Support, Red Hat Enterprise Linux 7.4 Advanced Update Support.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies.
The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code.
When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Weakness: CWE-787.
Affected products named by the advisory: Red Hat Enterprise Linux 6 Extended Lifecycle Support; Red Hat Enterprise Linux 7.3 Advanced Update Support; Red Hat Enterprise Linux 7.4 Advanced Update Support; Red Hat Enterprise Linux 7.6 Advanced Update Support; and 11 more.
CISA Known Exploited Vulnerability
- Listed:
- Jun 27, 2022 · federal remediation due Jul 18, 2022
- Required action:
- Apply updates per vendor instructions.
- Ransomware use:
- Known
KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
- polkit-0:0.96-11.el6_10.2
- polkit-0:0.112-26.el7_9.1
- polkit-0:0.112-12.el7_3.1
- polkit-0:0.112-12.el7_4.2
- polkit-0:0.112-18.el7_6.3
- polkit-0:0.112-22.el7_7.2
- polkit-0:0.115-13.el8_5.1
- polkit-0:0.115-9.el8_1.2
- polkit-0:0.115-11.el8_2.2
- polkit-0:0.115-11.el8_4.2
- redhat-virtualization-host-0:4.3.21-20220126.0.el7_9
- redhat-virtualization-host-0:4.4.10-202202081536_8.5
- RHSA-2022:0269
- RHSA-2022:0274
- RHSA-2022:0270
- RHSA-2022:0272
- RHSA-2022:0271
- RHSA-2022:0273
- RHSA-2022:0267
- RHSA-2022:0268
- RHSA-2022:0265
- RHSA-2022:0266
- RHSA-2022:0443
- RHSA-2022:0540
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Mitigation checklist
- For customers who cannot update immediately and doesn't have Secure Boot feature enabled, the issue can be mitigated by executing the following steps: 1) Install required systemtap packages and dependencies as per - pointed by https://access.redhat.com/solutions/5441 2) Install polkit debug info: ~~~ debuginfo-install polkit ~~~ 3) Create the following systemtap script, and name it pkexec-block.stp: ~~~ probe process("/usr/bin/pkexec").function("main") { if (cmdline_arg(1) == "") raise(9); } ~~~ 4) Load the systemtap module into the running kernel: ~~~ stap -g -F -m stap_pkexec_block pkexec_block.stp ~~~ 5) Ensure the module is loaded: ~~~ lsmod | grep -i stap_pkexec_block stap_pkexec_block 434176 0 ~~~ 6) Once polkit package was updated to the version containing the fix, the systemtap generated kernel module can be removed by running: ~~~ rmmod stap_pkexec_block ~~~ This mitigation doesn't work for Secure Boot enabled system as SystemTap would require an external compiling server to be able to sign the generated kernel module with a key enrolled into the Kernel's keyring.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.