12-Year-Old Polkit Flaw Lets Unprivileged Linux Users Gain Root Access

Red Hat's Polkit (PolicyKit), the component that enforces authorization policy for privileged D-Bus requests, fails to correctly verify credentials for D-Bus requests: when the calling client drops its connection before the authorization check completes, Polkit treats the request as if it came from a privileged process. A local, unprivileged user can trigger this by initiating a D-Bus call to a system service and terminating the connection at the right moment, making the race straightforward to hit with repeated attempts. A successful exploit bypasses the credential check and escalates the attacker's privileges to root on the affected host. Any Red Hat system shipping the vulnerable Polkit build is affected, and no public proof-of-concept is documented. The flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2023-05-12), which indicates known exploitation in the wild, though ransomware use is unknown.

Do: Apply updated Polkit packages per Red Hat's advisory instructions on all affected systems, and verify the running Polkit version matches the vendor's fixed release. Because the flaw is CISA KEV-listed with a 22.2% EPSS, prioritize patching on multi-user and internet-exposed hosts; where patching is delayed, restrict local shell access to untrusted users, since the flaw requires local access to trigger.

CVE-2021-4034 ('PwnKit') is an out-of-bounds read and write (CWE-125/CWE-787) in polkit's setuid-root pkexec utility, which mishandles the calling parameter count and ends up trying to execute environment variables as commands. A local attacker who runs pkexec with crafted environment variables can induce it to execute arbitrary code, gaining administrative (root) rights on the target machine. Because polkit is installed by default on mainstream Linux distributions — including Red Hat Enterprise Linux and its many variants, with the flaw also tracked against Canonical, SUSE, Oracle, Siemens, and StarWind Software products — essentially every standard Linux installation was exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-06-27 with known ransomware use, and EPSS assigns a 94.9% probability of exploitation (100th percentile). Public proof-of-concept exploits are widely available, making exploitation trivial for any user with local access to an unpatched host.

Do: Apply the polkit/pkexec updates from each distribution vendor immediately per vendor instructions, as required by the CISA KEV catalog. If patching must be delayed, removing the setuid bit from pkexec (e.g., chmod 0755 /usr/bin/pkexec) is a widely documented interim mitigation, though it may affect functionality that relies on pkexec. Prioritize hosts where untrusted or low-privilege users can log in, and hunt for prior exploitation given known ransomware use.

CVE-2022-0185 is a heap-based buffer overflow in the legacy_parse_param function of the Linux kernel's Filesystem Context (fs_context) functionality, rooted in an integer-handling flaw (CWE-190). A local attacker triggers it by opening or configuring a filesystem that does not support the Filesystem Context API, which overflows the heap buffer used to hold mount parameters. Successful exploitation lets the attacker escalate privileges on the host, and in environments with user namespaces enabled (common on desktops, shared servers, and containers) it can lead to full root compromise and container escape. Any Linux kernel build containing the vulnerable code is affected, which spans the very large installed base of Linux servers, cloud instances, containers, and devices. The vulnerability is confirmed exploited in the wild (added to CISA KEV on 2024-08-21), carries an EPSS 30-day exploitation probability of 25.2% (98th percentile), has no known public PoC, and its use in ransomware campaigns is unknown.

Do: Apply patched kernel packages from your distribution or vendor as soon as available and reboot to load the fixed kernel, per the KEV required action; do not continue running an unpatched vulnerable kernel. Where feasible, interim-mitigate by restricting or disabling unprivileged user namespaces (a common exploitation path), and prioritize hosts that are internet-facing, multi-tenant, or running containers. Verify remediation by confirming your running kernel is one of your vendor's patched builds, since no specific fixed version numbers are provided in this dataset.