CVE-2021-4034

HIGH severity · CVSS 7.8 · Out-of-bounds write · actively exploited (CISA KEV)

7.8CVSS HIGH ● exploited

🔴 Actively exploited in the wild (CISA Known Exploited Vulnerabilities). Added to KEV 2022-06-27. US federal agencies must patch by 2022-07-18.

Summary

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

Impact & exploitability

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)87%

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products we track (2)

Red Hat Enterprise Linux SUSE Linux Enterprise

Recommendation

This vulnerability is being actively exploited in the wild — patch affected products urgently. Open any affected product above for its exact safe version.

Official patch: https://bugzilla.redhat.com/show_bug.cgi?id=2025869 ↗

CVE-2021-4034

Summary

Impact & exploitability

Affected products we track (2)

Recommendation

Additional information