THE THREAT
On January 25th, 2022, a new vulnerability impacting Polkit’s pkexec program was disclosed. Polkit’s pkexec is included by default in all major Linux distributions. The vulnerability is tracked as CVE-2021-4034 (CVSS: 7.8) and allows for Local Privilege Escalation. Exploitation would enable a threat actor, with previous access to a vulnerable device, to escalate their privileges to full root privileges.
Exploitation of CVE-2021-4034 has not been identified at this time. eSentire has confirmed that functioning Proof-of-Concept exploit code is publicly available. Organizations are strongly encouraged to ensure that impacted systems are patched as soon as possible, as exploitation is expected in the immediate future.
What we’re doing about it
- eSentire Managed Vulnerability Service (MVS) has plugins in place to identify this vulnerability
- eSentire is in the process of developing detections for this threat
- eSentire security teams are tracking this threat for additional details and detection opportunities
What you should do about it
- After performing a business impact review, apply the relevant security patches
- If security patches cannot be immediately applied, consider removing the SUID-bit from Polkit pkexec as a temporary mitigation
- Additional details for mitigation actions may be found in the Qualys report and vendor releases
Additional information
Polkit’s pkexec is used to control system-wide privileges in Linux operating systems. It is meant to allow authorized users to run commands as the super user.
Exploitation has been tested and confirmed against Ubuntu, Debian, Fedora, and CentOS Linux distributions. Each impacted Linux distribution will be required to release their own updates to address CVE-2021-4034. Vendor responses can be found in the following links:
This list is expected to expand as distributions address CVE-2021-4034.
Exploits for CVE-2021-4034 are being widely shared by both researchers and threat actors. eSentire assesses, with high confidence, that this vulnerability will be adopted by threat actors for real world exploitation in a matter of days.
References:
[1] https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034
[2] https://linux.die.net/man/1/pkexec
[3] https://access.redhat.com/security/cve/CVE-2021-4034
[4] https://ubuntu.com/security/CVE-2021-4034
[5] https://security-tracker.debian.org/tracker/CVE-2021-4034
