How To Fix The Polkit Privilege Escalation Vulnerability (CVE-2021-4034)

The Qualys Research Team has disclosed a 12-year-old memory corruption vulnerability in polkit’s pkexec. The vulnerability is tracked as CVE-2021-4034 allows any unprivileged user to gain full root privileges on a vulnerable Linux machine. The research team confirmed that it has successfully tested this vulnerability on Ubuntu, Debian, Fedora, and CentOS with the default configuration. Since Plokit is part of the default packages on most Linux distributions, we can say that the whole Linux community is under threat. It is essential to fix the CVE-2021-4034 vulnerability as the flaw is being exploited in the wild. In this post, let’s see how to fix Polkit privilege escalation vulnerability in Linux machines.

What Is Polkit?

Polkit is formally known as PolicyKit, is a component for controlling system-wide privileges in Unix-like operating systems. It is developed to establish communication between non-privileged and privileged processes in an organized way. Pkexec is a command utility in Polkit used to execute commands with elevated privileges. A user can use pkexec as an alternative to sudo. If an unprivileged user wants to execute a command with root privileges, the user needs to prefix pkexec to the command intended to be executed. Pkexec command allows an unauthorized user to execute a command as another user. If no username is specified, the command will be executed as root.

To be more clear, Polkit is a small toolkit used for defining and handling authorizations on Unix/Linux platforms. It helps the unprivileged process to securely communicate with the privileged process. In essence, it stops unprivileged users from executing admin tasks. When a user tries to run a privileged task from $ prompt on Linux systems, the system will ask to enter a superuser password. That system is actually the Polkit service which is running under the line of control. It is installed by default on many Linux distributions. It’s used by the system, so any Linux distribution that uses systemd that also uses polkit.

Created by GitHub

About The Polkit Privilege Escalation Vulnerability (CVE-2021-4034):

The vulnerability is due to improper handling of command-line arguments by the pkexec tool. The report says, is a memory corruption vulnerability exists in polkit’s pkexec command that allows an unauthorized user to execute a command as another user. Successful exploitation of this vulnerability allows any unprivileged user to gain full root privileges on the vulnerable Linux machine. Since Polkit is part of the basic installation package in most of the Linux distributions, the whole Linux platform is considered vulnerable to the Polkit privilege escalation vulnerability.

The best thing about the flaw is that the flaw is not remotely exploitable. The attacker should have access to the machine to exploit the vulnerability.

Created by Qualys

This is the second privilege escalation vulnerability in Polkit after the discloser of CVE-2021-3560 in June 2021.

Linux Distributions Affected By The Polkit Privilege Escalation Vulnerability (CVE-2021-4034):

The flaw is successfully tested on Ubuntu, Debian, Fedora, and CentOS with default configuration. Since Polkit is part of the default installation package in most of the Linux distributions and all Polkit versions from 2009 onwards are vulnerable., the whole Linux platform is considered vulnerable to the Polkit privilege escalation vulnerability.

Major Linux Distributions Affected By The Polkit Privilege Escalation Vulnerability Are:

RedHat:

Ubuntu:

Suse:

Note: SUSE Linux Enterprise 11 is not affected, as it uses the older generation PolicyKit-1.