Linux Polkit Privilege Escalation Vulnerability (CVE-2021-4034)

I. Overview

Recently, a security research team disclosed a privilege escalation vulnerability (CVE-2021-4034, also dubbed PwnKit) in PolKit's pkexec. Unprivileged users can gain full root privileges on a vulnerable host by exploiting this vulnerability in its default configuration. Currently, the POC/EXP of this vulnerability has been disclosed, and the risk is high.

Polkit (formerly PolicyKit) is a component for controlling system-wide privileges in Unix-like operating systems. pkexec is a part of the Polkit framework. It executes commands with elevated permissions and is an alternative to Sudo. If you are a Polkit user, check your Polkit version and implement timely security hardening.

Reference link: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

II. Severity

Severity: important

(Severity: low, moderate, important, and critical)

III. Affected Products

Affected versions: all mainstream Linux versions

Secure versions: View the security bulletins of Linux vendors.

IV. Vulnerability Handling

  1. Currently, Linux vendors, such as Red Hat, Ubuntu, Debian, and SUSE, have released patches to fix this vulnerability. Upgrade your Linux OS to a secure version. If you are unable to update it in a timely manner, you can mitigate the risk by referring to the official suggestions provided by these vendors.

    RedHat, Ubuntu: USN-5252-1, USN-5252-2; Debian, SUSE

  2. EulerOS has released a patch. You only need to upgrade the polkit package (.rpm).

    The upgrade method is as follows:

    1. yum clean all
    2. yum makecache
    3. yum update polkit
    4. rpm -qa | grep polkit

      Check whether the OS has been upgraded to the corresponding version.

      • EulerOS 2.10: polkit-0.116-6.h4
      • EulerOS 2.9: polkit-0.116-5.h7
      • EulerOS 2.8: polkit-0.115-2.h14
      • EulerOS 2.5: polkit-0.112-14.h15
  3. If no patch is available in your system, run the # chmod 0755 /usr/bin/pkexec command to delete SUID-bit from pkexec.

Before fixing vulnerabilities, back up your files and conduct a thorough test.

Parent topic: Security Vulnerability Responses