A vulnerability, which was classified as critical, has been found in polkit (version now known). This issue affects some unknown processing of the file /usr/bin/pkexec. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

The weakness was presented 01/26/2022. It is possible to read the advisory at qualys.com. The identification of this vulnerability is CVE-2021-4034 since 11/29/2021. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

A public exploit has been developed by BLASTY in C and been published even before and not after the advisory. The exploit is available at haxx.in. It is declared as highly functional. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 06/27/2022 with a due date of 07/18/2022:

Apply updates per vendor instructions.

It is possible to mitigate the problem by applying the configuration setting chmod 0755 /usr/bin/pkexec.

See VDB-211432 for similar entry.

Productinfo

Name

• polkit

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #29334: Local Privilege Escalation in polkit's pkexec (by misc)

Discussion