Vulnerabilities

There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned

Red Hat's Polkit (PolicyKit), the component that enforces authorization policy for privileged D-Bus requests, fails to correctly verify credentials for D-Bus requests: when the calling client drops its connection before the authorization check completes, Polkit treats the request as if it came from a privileged process. A local, unprivileged user can trigger this by initiating a D-Bus call to a system service and terminating the connection at the right moment, making the race straightforward to hit with repeated attempts. A successful exploit bypasses the credential check and escalates the attacker's privileges to root on the affected host. Any Red Hat system shipping the vulnerable Polkit build is affected, and no public proof-of-concept is documented. The flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2023-05-12), which indicates known exploitation in the wild, though ransomware use is unknown.

Do: Apply updated Polkit packages per Red Hat's advisory instructions on all affected systems, and verify the running Polkit version matches the vendor's fixed release. Because the flaw is CISA KEV-listed with a 22.2% EPSS, prioritize patching on multi-user and internet-exposed hosts; where patching is delayed, restrict local shell access to untrusted users, since the flaw requires local access to trigger.

CVE-2021-4034 ('PwnKit') is an out-of-bounds read and write (CWE-125/CWE-787) in polkit's setuid-root pkexec utility, which mishandles the calling parameter count and ends up trying to execute environment variables as commands. A local attacker who runs pkexec with crafted environment variables can induce it to execute arbitrary code, gaining administrative (root) rights on the target machine. Because polkit is installed by default on mainstream Linux distributions — including Red Hat Enterprise Linux and its many variants, with the flaw also tracked against Canonical, SUSE, Oracle, Siemens, and StarWind Software products — essentially every standard Linux installation was exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-06-27 with known ransomware use, and EPSS assigns a 94.9% probability of exploitation (100th percentile). Public proof-of-concept exploits are widely available, making exploitation trivial for any user with local access to an unpatched host.

Do: Apply the polkit/pkexec updates from each distribution vendor immediately per vendor instructions, as required by the CISA KEV catalog. If patching must be delayed, removing the setuid bit from pkexec (e.g., chmod 0755 /usr/bin/pkexec) is a widely documented interim mitigation, though it may affect functionality that relies on pkexec. Prioritize hosts where untrusted or low-privilege users can log in, and hunt for prior exploitation given known ransomware use.

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command.

A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.