Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
High CVSS 7.8 Listed in CISA KEV
Summary
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- Red Hat:Polkit
- :
- :
- :
- :
- :
- :
- :
- :
Sources
- CISA KEV DATABASE
- NVD DATABASE
Original Links
- https://nvd.nist.gov/vuln/detail/CVE-2021-4034 advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog kev
- http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html Exploit
- http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html Third Party Advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2022-001 Mitigation
- https://bugzilla.redhat.com/show_bug.cgi?id=2025869 Issue Tracking
- https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf Third Party Advisory
- https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Patch
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch
- https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt Exploit
- https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/ Exploit
- https://www.starwindsoftware.com/security/sw-20220818-0001/ Third Party Advisory
- https://www.suse.com/support/kb/doc/?id=000020564 Third Party Advisory
- https://www.vicarius.io/vsociety/posts/pwnkit-pkexec-lpe-cve-2021-4034 Exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-4034 US Government Resource
Timeline
- kev_added CISA KEV
- kev_ingest CISA KEV
- nvd_ingest NVD