The CVE-2021-4034 in Polkit allows local attackers to gain full root access on most Linux systems via the pkexec utility.

Discovery of a Critical Linux Privilege Escalation Bug

Security researchers at Qualys discovered a major vulnerability affecting nearly all Linux distributions through a core system component. Because Polkit is installed by default on most Linux distributions, the vulnerability affects a very wide range of systems.

Introduction to the “PwnKit” Vulnerability

The flaw, tracked as CVE-2021-4034, was named “PwnKit” due to its ability to give attackers full system control. Although remote exploitation is not possible, any local user with system access could potentially escalate privileges.

Polkit: A Core Linux Authorization System

Polkit is used to manage permissions between unprivileged applications and privileged system services. Successful exploitation gives attackers complete control over the system, including files, processes, and user accounts.

Role of pkexec in Privilege Escalation

The vulnerable component, pkexec, acts similarly to sudo, allowing users to execute commands with elevated root privileges when authorized. Linux distributions quickly released patches to fix the vulnerability after its disclosure.

How pkexec Is Normally Used

Under normal conditions, pkexec prompts for authentication and checks system policies before granting temporary administrative access. The flaw highlights how small mistakes in privilege management tools like Polkit can lead to full system compromise.

Where the Vulnerability Exists

The bug lies in how pkexec handles environment variables and command execution when no proper command arguments are provided.

Exploitation Leads to Root Access

Attackers can exploit the flaw locally to bypass authentication checks and gain full root (UID 0) privileges on the system.