CVE-2021-4034
Published: 28 January 2022
Summary
CVE-2021-4034 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Redhat Enterprise Linux Server Aus. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
A local privilege escalation vulnerability exists in polkit's pkexec utility, a setuid tool that permits unprivileged users to execute commands as privileged users according to predefined policies. The flaw stems from incorrect handling of the argument count passed to pkexec, which causes the program to attempt execution of environment variables as commands. This issue is tracked as CVE-2021-4034 with a CVSS 3.1 base score of 7.8 and is associated with CWE-787 and CWE-125.
An attacker with local access and a low-privileged account can supply specially crafted environment variables to induce pkexec to run arbitrary code, resulting in full administrative rights on the affected system.
Public references include Red Hat's RHSB-2022-001 bulletin and associated Bugzilla entry, a Siemens security advisory, and multiple exploit postings on Packetstorm Security.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-33934
Vulnerability details
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the…
more
calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
- CWE(s)
- KEV Date Added
- 27 June 2022
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
pkexec is the access-enforcement mechanism that failed to correctly apply policy when argument count was mishandled, allowing environment variables to be executed with elevated rights.
Directly requires timely remediation of the identified flaw in polkit/pkexec that permits local privilege escalation.
Limits the privileges that can be obtained via the flawed pkexec setuid binary, reducing the impact of successful exploitation.