Vulnerabilities
By Date By Type Known Exploited Assigners CVSS Scores EPSS Scores Search
Vulnerable Software
Vendors Products Version Search
Metasploit Modules CWE Definitions
Articles Blog

Vulnerability Details : CVE-2021-4034

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
Vulnerability category: Memory CorruptionExecute codeGain privilege
Published 2022-01-28 20:15:12
Updated 2023-09-11 19:45:38
Source Red Hat, Inc.
View at NVD,   CVE.org
At least one public exploit which can be used to exploit this vulnerability exists!
CVE-2021-4034 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
Added on 2022-06-27 Action due date 2022-07-18

Exploit prediction scoring system (EPSS) score for CVE-2021-4034

Probability of exploitation activity in the next 30 days: 0.05%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 14 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2021-4034

  • Local Privilege Escalation in polkits pkexec
    Disclosure Date : 2022-01-25
    exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec
    A bug exists in the polkit pkexec binary in how it processes arguments. If the binary is provided with no arguments, it will continue to process environment variables as argument variables, but without any security checking. By using the execve call we can specify a null argument list and populate the proper environment variables. This exploit is architecture independent. Authors: - Qualys Security - Andris Raugulis - Dhiraj Mishra - bwatters-r7

CVSS scores for CVE-2021-4034

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Source
7.2
 HIGH AV:L/AC:L/Au:N/C:C/I:C/A:C
3.9
10.0
 [email protected]
7.8
 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1.8
5.9
 [email protected]

CWE ids for CVE-2021-4034

References for CVE-2021-4034

Products affected by CVE-2021-4034

This web site uses cookies for managing your session and website analytics (Google analytics) purposes as described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close