PolKit vulnerability can give attackers root on many Linux distros (CVE-2021-4034)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-4034 | Out-of-Bounds Read/Write Local Privilege Escalation in polkit pkexec (PwnKit) CVE-2021-4034 ('PwnKit') is an out-of-bounds read and write (CWE-125/CWE-787) in polkit's setuid-root pkexec utility, which mishandles the calling parameter count and ends up trying to execute environment variables as commands. A local attacker who runs pkexec with crafted environment variables can induce it to execute arbitrary code, gaining administrative (root) rights on the target machine. Because polkit is installed by default on mainstream Linux distributions — including Red Hat Enterprise Linux and its many variants, with the flaw also tracked against Canonical, SUSE, Oracle, Siemens, and StarWind Software products — essentially every standard Linux installation was exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-06-27 with known ransomware use, and EPSS assigns a 94.9% probability of exploitation (100th percentile). Public proof-of-concept exploits are widely available, making exploitation trivial for any user with local access to an unpatched host. Do: Apply the polkit/pkexec updates from each distribution vendor immediately per vendor instructions, as required by the CISA KEV catalog. If patching must be delayed, removing the setuid bit from pkexec (e.g., chmod 0755 /usr/bin/pkexec) is a widely documented interim mitigation, though it may affect functionality that relies on pkexec. Prioritize hosts where untrusted or low-privilege users can log in, and hunt for prior exploitation given known ransomware use. | 7.8 | 95% | KEV ransomware PoC ×4 |
| masstens of millions of Linux servers and workstations (polkit/pkexec ships by default on virtually all mainstream distributions) |
Full article409 words · extracted from helpnetsecurity.com · click to collapse
A memory corruption vulnerability (CVE-2021-4034) in PolKit, a component used in major Linux distributions and some Unix-like operating systems, can be easily exploited by local unprivileged users to gain full root privileges.
While the vulnerability is not exploitable remotely and doesn’t, in itself, allow arbitrary code execution, it can be used by attackers that have already gained a foothold on a vulnerable host to escalate their privileges and achieve that capability.
About the vulnerability (CVE-2021-4034)
CVE-2021-4034 – dubbed PwnKit by the Qualys researchers who unearthed it – is found in PolKit’s pkexec tool and was introduced in May 2009.
“Polkit (formerly PolicyKit) is a component for controlling system-wide privileges in Unix-like operating systems. It provides an organized way for non-privileged processes to communicate with privileged processes. It is also possible to use polkit to execute commands with elevated privileges using the command pkexec followed by the command intended to be executed (with root permission),” explained Bharat Jogi, Director of Vulnerability and Threat Research at Qualys.
Exploitability
PwnKit has been confirmed to be easily exploitable.
After finding the bug, creating an exploit and obtaining root privileges on default installations of Ubuntu, Debian, Fedora, and CentOS with it, Qualys researchers notified both the vendor (Red Hat Product Security) and open-source distributions so they could push out a patch.
The researchers haven’t shared the exploit, but said they “anticipate public exploits to become available within a few days of this blog’s post date.”
And they were right:
Wow, @theflow0 is a true visionary: https://t.co/uwLR65WjDY 🥲 https://t.co/FHLODKT9No
— BLASTY (@bl4sty) January 25, 2022
The efficacy of that exploit was confirmed quickly – also on an ARM64 system.
SANS ISC handler Bojan Zdrnja created one, too, and executed it on a Ubuntu 20.04 system that hasn’t been protected with the latest patch.
“Since most major distributions already released patches, the best option now is to install the patches. Of course, you’ll need to do it on all systems. If you cannot, or if there are no patches available, you can prevent the vulnerability from being exploited by removing the SUID bit from the pkexec tool; just make sure that you are not breaking anything,” he advised.
Qualys’s exploitation technique leaves traces in the logs, but they pointed out that there are ways to exploit the vulnerability without leaving such traces.
Users and admins are advised to implement the provided patches / updates as soon as possible, and especially on multi-user systems, Zdrnja noted.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/01/26/cve-2021-4034/