CVE-2021-3560
Red Hat Polkit Incorrect Authorization Vulnerability
Description
CVE-2021-3560 is a privilege escalation vulnerability in polkit (formerly PolicyKit), a system service used across major Linux distributions to manage authorization policies. The flaw allows an unprivileged local attacker to bypass polkit's credential checks for D-Bus requests, effectively elevating their privileges to root. By exploiting CVE-2021-3560, an attacker could create new local administrator accounts or execute arbitrary commands with full system privileges. This polkit vulnerability has been confirmed as actively exploited in the wild by CISA and carries an EPSS score of 10.9%, placing it in the 93rd percentile for exploitation probability, underscoring the urgency of patching affected Linux systems.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| polkit project | polkit | < 0.119 |
| debian | debian linux | 11.0 |
| canonical | ubuntu linux | 20.04 |
| redhat | virtualization | 4.0 |
| redhat | virtualization host | 4.0 |
| redhat | openshift container platform | 4.7 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/172836/polkit-Authentication-Bypass.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/172846/Facebook-Fizz-Denial-Of-Service.html(Third Party Advisory, VDB Entry)
- https://bugzilla.redhat.com/show_bug.cgi?id=1961710(Issue Tracking, Patch, Vendor Advisory)
- https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3560(US Government Resource)
Weakness Type
CWE-863: Incorrect Authorization
CWE-863 describes a condition where a system fails to properly verify that a requesting user has the necessary permissions to perform an action. In the case of CVE-2021-3560, polkit's authorization mechanism can be tricked into granting elevated privileges by sending a D-Bus request and then killing the process before polkit completes the credential check, causing polkit to treat the request as authorized by root.
Learn more: CWE-863 — Incorrect Authorization
CWE-754: Improper Check for Unusual or Exceptional Conditions
CWE-754 refers to software that does not properly handle unusual or unexpected input conditions. In the context of this polkit vulnerability, the flaw arises because polkit does not correctly handle the scenario where the requesting process terminates mid-authentication, leading to an improper authorization decision that grants root-level privileges.
Learn more: CWE-754 — Improper Check for Unusual or Exceptional Conditions
Impact Analysis
CVE-2021-3560 is a locally exploitable vulnerability that requires low privileges and no user interaction to trigger, making it straightforward for any authenticated user with shell access to exploit. Confidentiality (High): A successful exploit grants full root access, exposing all data on the affected system including credentials, configuration files, and sensitive user data. Integrity (High): With root privileges, an attacker can modify any file on the system, install backdoors, create new administrator accounts, or tamper with audit logs to cover their tracks. Availability (High): Root-level access allows an attacker to disrupt services, corrupt system files, or render the system inoperable. With a CVSS score of 7.8 (High severity) and an EPSS score in the 93rd percentile, this polkit privilege escalation vulnerability poses a significant risk to any unpatched Linux environment, particularly multi-user systems and virtualization platforms where local access is common.
Exploit Maturity
Public exploit code is available for CVE-2021-3560 via Packet Storm Security, and a detailed technical writeup with exploitation methodology has been published on GitHub Blog. CISA has confirmed active exploitation of this polkit vulnerability in the wild and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 2, 2023. The EPSS score of 10.9% with a 93rd percentile ranking indicates a notably elevated probability of exploitation compared to the broader vulnerability landscape. While the ransomware association is listed as unknown, the availability of public exploit code and confirmed active exploitation make immediate remediation essential for any organization running affected polkit versions.
Remediation
- Apply vendor patches immediately as directed by CISA: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Red Hat has released patches for polkit across affected distributions including RHEL, CentOS, and Fedora — update polkit to the latest patched version using your distribution's package manager.
- Update affected distributions including Debian Linux, Ubuntu Linux, Red Hat Virtualization, Red Hat Virtualization Host, and Red Hat OpenShift Container Platform to versions that include the polkit fix. Check vendor advisories at Red Hat Bugzilla for specific version guidance.
- Restrict local access as an interim mitigation by reviewing and limiting which users have shell access to affected systems, particularly on multi-user servers and virtualization hosts. Implement the principle of least privilege for D-Bus service access and consider restricting polkit configuration to limit which actions can be authorized.
- Monitor for exploitation indicators by reviewing system logs for unexpected account creation, privilege changes, or suspicious polkit authorization events. Check for newly created administrator accounts and audit auth log or journal entries related to polkit and D-Bus authentication.
- Harden authorization mechanisms long-term by implementing proper input validation and error handling for authorization workflows, ensuring that exceptional conditions such as premature process termination are handled securely and default to denying access rather than granting it.
Technical Details
The CVE-2021-3560 vulnerability in polkit stems from a race condition in how the polkit daemon handles D-Bus authentication requests. When a process sends a privileged D-Bus request, polkit initiates an authorization check by querying the requesting process's credentials via its PID. The core flaw is that if the requesting process is killed at precisely the right moment — after polkit receives the D-Bus request but before it completes the credential lookup — polkit fails to properly handle this exceptional condition (CWE-754). Instead of denying the request, polkit's error handling path inadvertently treats the now-orphaned request as originating from UID 0 (root), resulting in incorrect authorization (CWE-863). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects that while the attack requires local access and low-level user privileges, the exploitation complexity is low because the timing window can be reliably hit through repeated attempts. The scope remains unchanged as the vulnerability affects only the polkit authorization boundary, but the impact is total across confidentiality, integrity, and availability since successful exploitation yields unrestricted root access to the entire system.
Frequently Asked Questions
Is CVE-2021-3560 being actively exploited?
Yes, CVE-2021-3560 has been confirmed as actively exploited in the wild by CISA, which added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of June 2, 2023. The EPSS score of 10.9% (93rd percentile) further indicates elevated exploitation activity. Public exploit code and detailed technical writeups are readily available, lowering the barrier for exploitation.
What products are affected by CVE-2021-3560?
CVE-2021-3560 affects polkit (PolicyKit) across multiple Linux distributions and platforms, including Debian Linux, Canonical Ubuntu Linux, Red Hat Virtualization, Red Hat Virtualization Host, and Red Hat OpenShift Container Platform. Any Linux system running a vulnerable version of polkit is potentially affected, as polkit is a core system component used for privilege management.
How do I fix CVE-2021-3560?
The primary remediation is to update polkit to a patched version through your Linux distribution's package manager. Red Hat, Debian, Ubuntu, and other affected vendors have released security updates. If patching is not immediately possible, restrict local shell access to affected systems and monitor for suspicious privilege escalation or account creation activity.
How severe is CVE-2021-3560?
CVE-2021-3560 is rated High severity with a CVSS score of 7.8 out of 10.0 (CVSS v3.1). The vulnerability enables full root privilege escalation from a low-privileged local account without requiring any user interaction. Its EPSS percentile of 93.2% places it among the most likely-to-be-exploited vulnerabilities, and its inclusion in the CISA KEV catalog confirms real-world exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.