CVE-2021-4034
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
Description
CVE-2021-4034, commonly known as "PwnKit," is an out-of-bounds read and write vulnerability in the Red Hat polkit pkexec utility that allows unprivileged local users to escalate privileges to root on virtually any Linux system with Polkit installed. The vulnerability has existed in pkexec since its introduction in 2009, affecting all major Linux distributions. CISA has added CVE-2021-4034 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 86.7% (99.4th percentile), this vulnerability has near-certain exploitation probability and is one of the most widely exploited Linux privilege escalation vulnerabilities in recent history.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| polkit project | polkit | < 121 |
| redhat | enterprise linux server update services for sap solutions | 7.6; 7.7; 8.1; 8.2; 8.4 |
| redhat | enterprise linux | 8.0 |
| redhat | enterprise linux desktop | 7.0 |
| redhat | enterprise linux eus | 8.2 |
| redhat | enterprise linux for ibm z systems | 7.0; 8.0 |
| redhat | enterprise linux for ibm z systems eus | 8.2; 8.4 |
| redhat | enterprise linux for power big endian | 7.0 |
| redhat | enterprise linux for power little endian | 7.0; 8.0 |
| redhat | enterprise linux for power little endian eus | 8.1; 8.2; 8.4 |
| redhat | enterprise linux for scientific computing | 7.0 |
| redhat | enterprise linux server | 6.0; 7.0 |
| redhat | enterprise linux server aus | 7.3; 7.4; 7.6; 7.7; 8.2; 8.4 |
| redhat | enterprise linux server eus | 8.4 |
| redhat | enterprise linux server tus | 7.6; 7.7; 8.2; 8.4 |
| redhat | enterprise linux workstation | 7.0 |
| canonical | ubuntu linux | 14.04; 16.04; 18.04; 20.04; 21.10 |
| suse | enterprise storage | 7.0 |
| suse | linux enterprise high performance computing | 15.0 |
| suse | manager proxy | 4.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html(Third Party Advisory, VDB Entry)
- https://access.redhat.com/security/vulnerabilities/RHSB-2022-001(Mitigation, Vendor Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=2025869(Issue Tracking, Patch)
- https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf(Third Party Advisory)
- https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683(Patch)
- https://www.oracle.com/security-alerts/cpuapr2022.html(Patch, Third Party Advisory)
- https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt(Exploit, Mitigation, Third Party Advisory)
- https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/(Exploit, Third Party Advisory)
- https://www.starwindsoftware.com/security/sw-20220818-0001/(Third Party Advisory)
- https://www.suse.com/support/kb/doc/?id=000020564(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/pwnkit-pkexec-lpe-cve-2021-4034(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-4034(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2021-4034 exploits an out-of-bounds read and write vulnerability in the pkexec utility, where a flaw in how pkexec handles its command-line arguments allows an attacker to cause an out-of-bounds memory access. By calling pkexec with a carefully controlled environment, the attacker can trigger a write beyond the intended memory boundaries, corrupting critical data structures and ultimately achieving arbitrary code execution as root.
Learn more: CWE-787 — Out-of-bounds Write
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
The underlying memory safety issue in pkexec falls under the broader category of improper buffer boundary enforcement, where the utility's argument parsing logic does not properly restrict memory operations within the bounds of its allocated buffers.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2021-4034 is one of the most impactful Linux privilege escalation vulnerabilities discovered in recent years. The vulnerability exists in Polkit's pkexec, a SUID-root program installed by default on virtually every major Linux distribution including Ubuntu, Debian, Fedora, CentOS, and RHEL. Any unprivileged local user can exploit this vulnerability to gain full root access without requiring any special configuration or permissions beyond basic shell access. Confidentiality is completely compromised as root access provides unrestricted access to all files and data; integrity is fully at risk as root can modify any system component; and availability can be completely disrupted through system manipulation. The EPSS score of 86.7% (99.4th percentile) and the 13-year window during which this vulnerability was present confirm its significance as a critical threat to Linux infrastructure.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-4034 in the wild by adding it to the Known Exploited Vulnerabilities catalog on June 27, 2022, with a remediation deadline of July 18, 2022. The vulnerability, dubbed "PwnKit" by its discoverers at Qualys, has multiple reliable public exploits available that provide instant root access on vulnerable systems. The EPSS score of 86.7% (99.4th percentile) indicates near-certain exploitation activity. Exploitation is trivial — publicly available exploit code requires only a single command to execute and provides immediate root access, making it accessible to attackers of any skill level. The vulnerability has been widely adopted as a post-compromise privilege escalation tool by both penetration testers and malicious actors.
Remediation
- Apply Linux distribution security updates immediately: Install the patched version of Polkit provided by your Linux distribution's package manager (apt, yum, dnf) that addresses CVE-2021-4034.
- Remove the SUID bit from pkexec as a temporary mitigation: If immediate patching is not possible, remove the SUID bit from pkexec by running
chmod 0755 /usr/bin/pkexec, which prevents the privilege escalation while potentially affecting legitimate pkexec functionality. - Audit all Linux systems for the vulnerable pkexec version: Conduct an inventory of all Linux systems to identify instances running the vulnerable version of pkexec, including servers, workstations, containers, and virtual machines.
- Monitor for exploitation attempts: Implement detection rules for CVE-2021-4034 exploitation patterns, including monitoring for pkexec processes spawned with unusual arguments or environment variables.
- Restrict shell access on sensitive systems: Apply the principle of least privilege by limiting which users have shell access to production servers, reducing the pool of potential local attackers who could exploit this vulnerability.
Technical Details
CVE-2021-4034 ("PwnKit") is a memory corruption vulnerability in Polkit's pkexec utility that has existed since the program's initial commit in 2009. The vulnerability lies in how pkexec processes its command-line arguments. When pkexec is executed with argc equal to zero (no arguments), a flaw in the argument parsing logic causes an out-of-bounds read from argv, which reads past the end of the argument array into the environment variable array. This read/write beyond the intended memory boundaries allows the attacker to manipulate environment variables in a way that causes pkexec to load attacker-controlled shared libraries. Because pkexec is a SUID-root program, the injected code executes with root privileges. The exploit is extremely reliable and does not require ASLR bypass or other exploitation complexity — the memory corruption directly translates to controlled code execution. The 13-year dormancy of this vulnerability in a universally deployed SUID binary highlights the challenges of memory safety in C code and the importance of security auditing in privilege-sensitive system utilities.
Frequently Asked Questions
Is CVE-2021-4034 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2021-4034 (PwnKit) by adding it to the Known Exploited Vulnerabilities catalog. Multiple public exploits are available that provide instant root access, and the EPSS score of 86.7% (99.4th percentile) confirms near-certain exploitation activity.
What products are affected by CVE-2021-4034?
CVE-2021-4034 affects virtually every major Linux distribution through the Polkit pkexec utility. This includes Ubuntu, Debian, Fedora, CentOS, RHEL, and any other distribution that ships Polkit. The vulnerability has existed since 2009, meaning all versions prior to the security fix are affected.
How do I fix CVE-2021-4034?
Update Polkit through your distribution's package manager to the patched version. As a temporary workaround, remove the SUID bit from pkexec with chmod 0755 /usr/bin/pkexec. Audit all Linux systems for the vulnerable version.
How severe is CVE-2021-4034?
CVE-2021-4034 is one of the most severe Linux privilege escalation vulnerabilities in recent history, with an EPSS score of 86.7% (99.4th percentile). Any unprivileged local user can exploit it to gain root access on virtually any Linux system. The trivial exploitation and universal presence of pkexec make this a critical patching priority for all Linux environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.