CoreCVE
Back

HIGH KEV Used in ransomware campaigns

polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

Published Jan 28, 2022 ·Due Jul 18, 2022

Description

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

Affected products

Remediation

Red Hat mitigation

For customers who cannot update immediately and doesn't have Secure Boot feature enabled, the issue can be mitigated by executing the following steps: 1) Install required systemtap packages and dependencies as per - pointed by https://access.redhat.com/solutions/5441 2) Install polkit debug info: ~~~ debuginfo-install polkit ~~~ 3) Create the following systemtap script, and name it pkexec-block.stp: ~~~ probe process("/usr/bin/pkexec").function("main") { if (cmdline_arg(1) == "") raise(9); } ~~~ 4) Load the systemtap module into the running kernel: ~~~ stap -g -F -m stap_pkexec_block pkexec_block.stp ~~~ 5) Ensure the module is loaded: ~~~ lsmod | grep -i stap_pkexec_block stap_pkexec_block 434176 0 ~~~ 6) Once polkit package was updated to the version containing the fix, the systemtap generated kernel module can be removed by running: ~~~ rmmod stap_pkexec_block ~~~ This mitigation doesn't work for Secure Boot enabled system as SystemTap would require an external compiling server to be able to sign the generated kernel module with a key enrolled into the Kernel's keyring.

Metrics

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-787

Out-of-bounds Write

References (17)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Jan 28, 2022
Updated Aug 15, 2026
Reserved Nov 29, 2021
Link CVE-2021-4034
CISA Vulnrichment
Updated Oct 12, 2025
NVD
Status Analyzed
Modified Aug 15, 2026
Link CVE-2021-4034
Red Hat
Severity Important
Public date Jan 25, 2022
Links CVE-2021-4034 - Bugzilla