CVE-2021-4034

Published Jan 28, 2022

Last updated 2 months ago

Exploit knownCVSS high 7.8
Ubuntu

Overview

AI description

Automated description summarized from trusted sources.

CVE-2021-4034, commonly known as "PwnKit," is a local privilege escalation vulnerability found in Polkit's `pkexec` utility. The `pkexec` application is a setuid tool designed to allow unprivileged users to run commands with elevated privileges according to predefined policies. This flaw, present in all versions of `pkexec` since its introduction in May 2009, stems from improper handling of command-line arguments. Specifically, the vulnerability occurs during the argument parsing phase when `pkexec` is executed without any command-line arguments (where `argc` equals 0). In this scenario, `pkexec` incorrectly processes memory beyond the bounds of the `argv` array. Due to how Linux processes organize memory, the `argv` and `envp` (environment variable) arrays are contiguous, meaning `pkexec` reads from the beginning of the environment variables when it reads past the end of `argv`. This allows an attacker to manipulate environment variables, such as `GCONV_PATH`, to inject a malicious shared library path, tricking `pkexec` into loading and executing attacker-controlled code with root privileges.

Description
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
Source
secalert@redhat.com
NVD status
Analyzed
Products
polkit, enterprise_linux_server_update_services_for_sap_solutions, enterprise_linux, enterprise_linux_desktop, enterprise_linux_eus, enterprise_linux_for_ibm_z_systems, enterprise_linux_for_ibm_z_systems_eus, enterprise_linux_for_power_big_endian, enterprise_linux_for_power_little_endian, enterprise_linux_for_power_little_endian_eus, enterprise_linux_for_scientific_computing, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_server_eus, enterprise_linux_server_tus, enterprise_linux_workstation, ubuntu_linux, enterprise_storage, linux_enterprise_high_performance_computing, manager_proxy, manager_server, linux_enterprise_desktop, linux_enterprise_server, linux_enterprise_workstation_extension, http_server, zfs_storage_appliance_kit, sinumerik_edge, scalance_lpe9403_firmware, command_center, starwind_virtual_san

Risk scores

CVSS 3.1

Type
Primary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

CVSS 2.0

Type
Primary
Base score
7.2
Impact score
10
Exploitability score
3.9
Vector string
AV:L/AC:L/Au:N/C:C/I:C/A:C

Known exploits

Data from CISA

Vulnerability name
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
Exploit added on
Jun 27, 2022
Exploit action due
Jul 18, 2022
Required action
Apply updates per vendor instructions.

Weaknesses

secalert@redhat.com
CWE-787
nvd@nist.gov
CWE-125

Social media

Hype score
Not currently trending

  1. 10件の脆弱性でランサムウェアによる悪用が確認された。米国サイバーセキュリティ・社会基盤安全保障庁(CISA)の既知の悪用された脆弱性が更新。対象は以下。 - CVE-2025-60710 (Windows) - CVE-2020-29574 (CyberoamOS) - CVE-2

    @__kokumoto

    15 Aug 2026

    2353 Impressions

    1 Retweet

    19 Likes

    10 Bookmarks

    0 Replies

    1 Quote

  2. Top 5 Trending CVEs: 1 - CVE-2025-24200 2 - CVE-2025-32711 3 - CVE-2013-3219 4 - CVE-2021-4034 5 - CVE-2007-6249 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W

    @CVEShield

    10 Nov 2025

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Threat Alert: Perfctl malware exploiting exposed Portainer agent and using new SSH persistence CVE-2021-4043 CVE-2023-33246 CVE-2021-4034 Severity: ⚠️ Critical Maturity: 💥 Mainstream Learn more: https://t.co/USc4CE0FKR #CyberSecurity #ThreatIntel #InfoSec (1/3)

    @fletch_ai

    19 Dec 2024

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

Configurations

Related CVEs

  1. A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion can lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services.•CVE-2026-104046
  2. A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service.•CVE-2026-104045
  3. A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.•CVE-2026-104048
  4. A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory.•CVE-2026-104047
  5. A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed.•CVE-2026-88252

References

Sources include official advisories and independent security research.