QID 376287

Date Published: 2022-01-25

QID 376287: Polkit pkexec Local Privilege Escalation Vulnerability (PwnKit)

Polkit (formerly PolicyKit) is a component for controlling system-wide privileges in Unix-like operating systems. Polkit additionally allows an authorized user to execute PROGRAM as another user. If username is not specified then it defaults to root.

We discovered a memory corruption vulnerability that allow Local Privilege Escalation (from any user to root) in polkit's pkexec, a SUID-root program that is installed by default on every major Linux distribution. It has been given the name PwnKit.

Affected Versions:
All versions of PolKit

QID Detection Logic:
The QID checks for vulnerable instances of polkit by running a specially crafted command using python which triggers an error message on vulnerable hosts. The error message is "Cannot run program PROGRAM=nonexistent: No such file or directory". On Solaris we only check if polkit exists or not.

The vulnerability allows any unprivileged user to gain full root privileges on an affected host by exploiting this vulnerability in its default configuration.

CVSS V3 rated as High - 7.8 severity.

CVSS V2 rated as High - 7.2 severity.

Solution

Customer are advised to patch to the latest version of Polkit.

Vendor References

Polkit pkexec Local Privilege Escalation - www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

CVEs related to QID 376287

CVE-2021-4034 |

Software Advisories

Advisory ID	Software	Component	Link
Polkit pkexec Local Privilege Escalation			www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].