CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability

Vulnerability summary

CVE-2021-4034 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in Red Hat Polkit. It is known to be exploited: CISA lists it, first on 27-06-2022. It has been used in ransomware campaigns. EPSS estimates a 94.92% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 6 public exploits are recorded.

Timeline

1. 28-01-2022
   PublishedVulnerability first disclosed.
2. 27-06-2022
   Added to CISA KEVRed Hat Polkit Out-of-Bounds Read and Write Vulnerability
3. 18-07-2022
   CISA remediation dueApply updates per vendor instructions.
4. 15-08-2026
   Last modifiedVulnerability information updated.

Description

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.