CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
A Local Privilege Escalation vulnerability (from any user to root) was found in polkit's pkexec, a SUID-root program that is installed by default on every major Linux distribution.
Other sources
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/polkitto a version that resolves this vulnerability.Fixed in 0:0.96-11.el6_10.2 - Upgrade
Upgrade
redhat/polkitto a version that resolves this vulnerability.Fixed in 0:0.112-26.el7_9.1 - Upgrade
Upgrade
redhat/polkitto a version that resolves this vulnerability.Fixed in 0:0.112-12.el7_3.1 - Upgrade
Upgrade
redhat/polkitto a version that resolves this vulnerability.Fixed in 0:0.112-12.el7_4.2 - Upgrade
Upgrade
redhat/polkitto a version that resolves this vulnerability.Fixed in 0:0.112-18.el7_6.3 - Upgrade
Upgrade
redhat/polkitto a version that resolves this vulnerability.Fixed in 0:0.112-22.el7_7.2 - Upgrade
Upgrade
redhat/polkitto a version that resolves this vulnerability.Fixed in 0:0.115-13.el8_5.1 - Upgrade
Upgrade
redhat/polkitto a version that resolves this vulnerability.Fixed in 0:0.115-9.el8_1.2 - Upgrade
Upgrade
redhat/polkitto a version that resolves this vulnerability.Fixed in 0:0.115-11.el8_2.2 - Upgrade
Upgrade
redhat/polkitto a version that resolves this vulnerability.Fixed in 0:0.115-11.el8_4.2 - Upgrade
Upgrade
redhat/redhat-virtualization-hostto a version that resolves this vulnerability.Fixed in 0:4.3.21-20220126.0.el7_9 - Configuration
Create a systemtap script named pkexec-block.stp with the provided contents that probe process("/usr/bin/pkexec").function("main"), raise(9), and then rmmod stap_pkexec_block.
systemtap script script name pkexec blocking = pkexec-block.stp - Compensating control
Mitigate the polkit pkexec local privilege escalation on systems that cannot be updated and do NOT have Secure Boot enabled by using the provided systemtap procedure (requires installing the referenced systemtap packages/dependencies, installing polkit debuginfo, creating pkexec-block.stp, loading the generated systemtap kernel module, verifying it is loaded, and removing it after polkit is updated).
- Operational
Install required systemtap packages and dependencies as referenced in the Red Hat solution 5441 (access.redhat.com/solutions/5441).
- Operational
Install polkit debug information (debuginfo) by running: debuginfo-install polkit.
- Operational
Load the systemtap generated kernel module into the running kernel and ensure it is loaded by running: stap -g -F -m stap_pkexec_block pkexec_block.stp, then verify with: lsmod | grep -i stap_pkexec_block.
- Operational
After polkit is updated to the version containing the fix, remove the systemtap-generated kernel module by running the command shown in the mitigation text (rmmod stap_pkexec_block / removal step referenced as part of the provided procedure).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-4034?
CVE-2021-4034 is considered a high severity vulnerability that allows for local privilege escalation.
How do I fix CVE-2021-4034?
To fix CVE-2021-4034, update the polkit package to a version that is patched, such as 0:0.96-11.el6_10.2 or higher for Red Hat systems.
What causes CVE-2021-4034?
CVE-2021-4034 is caused by an out-of-bounds read and write vulnerability within the pkexec utility of the polkit package.
Which systems are affected by CVE-2021-4034?
CVE-2021-4034 affects multiple versions of Red Hat Enterprise Linux and systems using the polkit package, particularly versions prior to the fix releases.
Can CVE-2021-4034 be exploited remotely?
No, CVE-2021-4034 requires local access to exploit, as it involves privilege escalation using a setuid tool.