Linux Polkit privilege escalation vulnerability warning

2023-03-31

Respectful master's command:

Hello! A foreign security research team disclosed that there is a privilege escalation vulnerability in polkit's pkexec program. (CVE-2021-4034, also known as PwnKit).

[Vulnerability Rating]

High risk

[Vulnerability description]

CVE-2021-4034

An attacker can exploit this vulnerability in its default configuration to obtain full root permissions of the vulnerable host with any unprivileged user. Currently, the vulnerability POC/EXP has been disclosed and the risk is high.

[scope of influence]

This vulnerability affects all polkit versions from May 2009 to the present. Since polkit is a pre-installed tool on the system, all Linux systems where polkit exists are affected.

[Repair Plan]

At present, major Linux manufacturers such as RedHat, Ubuntu, Debian, and SUSE have released patch versions to fix this vulnerability. Affected users are asked to upgrade to a safe version.

Back to List