Just in Time Bulletin: CVE-2021-4034 PwnKit

What is PwnKit (CVE-2021-4034)?

CVE-2021-4034 known as PwnKit is a local privilege escalation vulnerability found in the ‘pkexec’ command line utility. Pkexec is a SUID-root program deployed by default on all major Linux distributions as part of PolKit (policy kit), which manages process privileges. 

Pkexec fails to properly count the number of arguments passed to it, which results in an out-of-bounds write vulnerability that enables an attacker to inject crafted payloads into environment variables that facilitate arbitrary code execution. Successful execution of arbitrary code on vulnerable systems results in trivial privilege escalation as ‘root’.

How bad is this? 

Active exploitation today: Exploited in the wild, proof of concept code publicly available. 

Severity: Critical

• Local privilege escalation
• Results in trivial ‘root’ access on vulnerable systems
• Likely to be chained with other vulnerabilities (Log4Shell), malware, and rootkits

Who is affected by this? 

• Ubuntu 14.04, 16.04, 18.04 and 20.04
• Debian 9 and 10
• RHEL 6, 7 and 8
• Amazon Linux AMI 2

How are they exploited? 

Exploitation requires local access to a vulnerable system, which minimizes the risk of unauthorized access by remote attackers. However, the exploit is relatively simple and the payload executed via ‘execve()’ injects NULL arguments and crafted environment variables when executing ‘pkexec’, which ultimately causes an error, leading to memory corruption, resulting in the execution of unauthorized code as ‘root’.

Am I at Risk? 

If PolicyKit is not installed on your system, then you are not affected by PwnKit. However, PolicyKit is installed by default on nearly all major Linux operating systems, with the exception of Debian. On Debian platforms PolictyKit is a dependency to other packages and is most likely present.

To determine if you’re at risk, execute the following command:

$ dpkg -s policykit-1 | grep Version
Version: 0.105-30ubuntu0.1

The below table provides detailed information on fixed versions of polkit, any version older than the fixed version is vulnerable.

How do I protect myself? 

It is recommended that polkit is immediately updated to the fixed version listed above.

To mitigate the issue without updating polkit, it is possible to remove the setuid permission from pkexec, however this could impact services that rely on pkexec for root privileges. To change the permissions execute the following command.

$chmod 0755 $(which pkexec)

Additional Resources: 

• RadHat: https://access.redhat.com/security/vulnerabilities/RHSB-2022-001
• Ubuntu: https://ubuntu.com/security/notices/USN-5252-1
• Debian: https://security-tracker.debian.org/tracker/CVE-2021-4034
• https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-403