CVE-2021-3560: Red Hat Polkit Incorrect Authorization Vulnerability

Vulnerability summary

CVE-2021-3560 is a high (CVSS 7.8) Incorrect Authorization vulnerability in Red Hat Polkit. It is known to be exploited: CISA lists it, first on 12-05-2023. EPSS estimates a 23.71% chance of exploitation in the next 30 days, higher than 97.8% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 16-02-2022
   PublishedVulnerability first disclosed.
2. 12-05-2023
   Added to CISA KEVRed Hat Polkit Incorrect Authorization Vulnerability
3. 02-06-2023
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
• CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.