A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
Published 2022-01-28 20:15:12
Updated 2023-10-18 01:15:26
Source Red Hat, Inc.
View at NVD,   CVE.org
Vulnerability category: Memory CorruptionExecute codeGain privilege

Threat overview for CVE-2021-4034

Top countries where our scanners detected CVE-2021-4034
Top open port discovered on systems with this issue 53
IPs affected by CVE-2021-4034 56,930
Threat actors abusing to this issue? Yes
Find out if you* are affected by CVE-2021-4034!
*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

CVE-2021-4034 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
Added on 2022-06-27 Action due date 2022-07-18

Exploit prediction scoring system (EPSS) score for CVE-2021-4034

Probability of exploitation activity in the next 30 days EPSS Score History
~ 14 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2021-4034

  • Local Privilege Escalation in polkits pkexec
    Disclosure Date: 2022-01-25
    First seen: 2022-12-23
    A bug exists in the polkit pkexec binary in how it processes arguments. If the binary is provided with no arguments, it will continue to process environment variables as argument variables, but without any security checking. By using the execve call we can s

CVSS scores for CVE-2021-4034

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen

CWE ids for CVE-2021-4034

  • The product reads data past the end, or before the beginning, of the intended buffer.
    Assigned by:
    • nvd@nist.gov (Primary)
    • secalert@redhat.com (Secondary)
  • The product writes data past the end, or before the beginning, of the intended buffer.
    Assigned by:
    • nvd@nist.gov (Primary)
    • secalert@redhat.com (Secondary)

References for CVE-2021-4034

Products affected by CVE-2021-4034

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!