Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2021-3560 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2021-3560 is a privilege escalation flaw in polkit that allows the component to be tricked into bypassing credential checks for D-Bus requests. Successful exploitation elevates the privileges of the requestor to the root user. The vulnerability is tracked under CWE-863 and CWE-754 and carries a CVSS 3.1 base score of 7.8.
An unprivileged local attacker can exploit the issue to perform actions such as creating a new local administrator account. The attack requires local access, low attack complexity, and no user interaction, resulting in high impact to confidentiality, integrity, and availability.
Public references, including a Red Hat Bugzilla entry and a detailed analysis on the GitHub Security Lab blog, discuss the flaw and link to related proof-of-concept material on Packet Storm.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-26871
Vulnerability Data
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create…
more
a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- CWE(s)
- KEV Date Added
- 12 May 2023
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Periodic review and update of procedures reduces incorrect authorization implementations over time.
Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.
Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.
The authorization process and usage restrictions help prevent incorrect authorization for remote access types.
Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.
Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.
Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.
Ensures authorization decisions for external system use are correctly implemented and enforced.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.
A.5.18's provisioning, revocation, review and adjustment of access rights (incl. before role changes/termination, with segregation and owner approval) directly stops incorrect authorization decisions from being exploitable in the vast majority of cases; the bounded remainder is incorrectness inside the authorization logic itself (e.g. flawed conditional or missing check) rather than rights that were wrongly granted.
Logging can record unhandled exceptions but does not prevent the weakness itself.
Monitoring may detect symptoms of unhandled conditions but does not eliminate the root weakness.
Secure development life cycle mandates exception handling and input validation that directly prevent missing checks for unusual conditions.
Application security requirements explicitly call for handling of exceptional conditions and error paths.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-863, a class-level weakness, and none of its children carries one either.
- No fine-grained STIG row for CWE-754, a class-level weakness. Rules are authored against its narrower children: CWE-354.