CVE-2021-4034

Q: What is the severity of CVE-2021-4034?

CVE-2021-4034 has a CVSS score of 7.8 (HIGH). CVE-2021-4034 (PwnKit) is a local privilege escalation vulnerability in polkit's pkexec utility that allows unprivileged local users to gain root privileges by exploiting improper argument handling. This affects all Linux systems with polkit installed, which is present by default on most modern Linux distributions. The vulnerability is particularly dangerous because it's easy to exploit and requires no user interaction.

7.8 HIGH

📋 TL;DR

CVE-2021-4034 (PwnKit) is a local privilege escalation vulnerability in polkit's pkexec utility that allows unprivileged local users to gain root privileges by exploiting improper argument handling. This affects all Linux systems with polkit installed, which is present by default on most modern Linux distributions. The vulnerability is particularly dangerous because it's easy to exploit and requires no user interaction.

💻 Affected Systems

Products:

polkit
pkexec

Versions: All versions from initial release up to and including polkit 0.120

Operating Systems: Linux distributions including RHEL, CentOS, Ubuntu, Debian, SUSE, Fedora, and others

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerable if polkit is installed, which is default on most modern Linux distributions. Some minimal/containerized installations may not have polkit.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise where any local user (including low-privileged service accounts) can gain root privileges and execute arbitrary code with full system control.

🟠

Likely Case

Local privilege escalation leading to administrative access, data theft, persistence establishment, and lateral movement within the environment.

🟢

If Mitigated

Limited impact if proper access controls, least privilege principles, and monitoring are in place to detect privilege escalation attempts.

🌐 Internet-Facing: LOW - This is a local privilege escalation vulnerability requiring local access to the system.

🏢 Internal Only: HIGH - Any compromised low-privileged account or service within the internal network can escalate to root, making this extremely dangerous for internal systems.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ✅ No

Complexity: LOW

Multiple public proof-of-concept exploits are available. Exploitation requires local access but no authentication beyond having a user account. The exploit is simple and reliable.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: polkit 0.121 and later

Vendor Advisory: https://access.redhat.com/security/vulnerabilities/RHSB-2022-001

Restart Required: No

Instructions:

1. Update polkit package using your distribution's package manager. 2. For RHEL/CentOS: 'yum update polkit'. 3. For Ubuntu/Debian: 'apt update && apt upgrade polkit'. 4. Verify the update installed polkit version 0.121 or higher.

🔧 Temporary Workarounds

Remove SUID bit from pkexec

linux

Removes the setuid permission from pkexec, preventing privilege escalation but breaking legitimate pkexec functionality

chmod 0755 /usr/bin/pkexec

Temporary mitigation via chmod 0

linux

Completely disables pkexec by removing execute permissions

chmod 0 /usr/bin/pkexec

🧯 If You Can't Patch

Implement strict access controls and limit local user accounts
Monitor for privilege escalation attempts and pkexec usage in logs

🔍 How to Verify

Check if Vulnerable:

Check polkit version: 'pkexec --version' or 'rpm -q polkit' or 'dpkg -l policykit-1'. If version is 0.120 or earlier, system is vulnerable.

Check Version:

pkexec --version 2>/dev/null || rpm -q polkit 2>/dev/null || dpkg -l policykit-1 2>/dev/null | grep ^ii

Verify Fix Applied:

Verify polkit version is 0.121 or higher: 'pkexec --version' should show 0.121+. Test with known exploit PoC to confirm failure.

📡 Detection & Monitoring

Log Indicators:

Unusual pkexec invocations
Failed privilege escalation attempts
Process execution with unexpected parent-child relationships

Network Indicators:

None - this is a local privilege escalation

SIEM Query:

process.name:"pkexec" AND user.name!="root" AND process.parent.name NOT IN ("sudo", "su", "systemd", "login")

📊 Metadata

CVE ID: CVE-2021-4034

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: January 28, 2022

Last Updated: November 6, 2025

🔗 References

http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html Third Party Advisory,VDB Entry
https://access.redhat.com/security/vulnerabilities/RHSB-2022-001 Mitigation,Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2025869 Issue Tracking,Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf Third Party Advisory
https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Patch
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt Exploit,Mitigation,Third Party Advisory
https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/ Exploit,Third Party Advisory
https://www.starwindsoftware.com/security/sw-20220818-0001/ Third Party Advisory
https://www.suse.com/support/kb/doc/?id=000020564 Third Party Advisory
http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html Third Party Advisory,VDB Entry
https://access.redhat.com/security/vulnerabilities/RHSB-2022-001 Mitigation,Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2025869 Issue Tracking,Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf Third Party Advisory
https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Patch
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt Exploit,Mitigation,Third Party Advisory
https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/ Exploit,Third Party Advisory
https://www.starwindsoftware.com/security/sw-20220818-0001/ Third Party Advisory
https://www.suse.com/support/kb/doc/?id=000020564 Third Party Advisory
https://www.vicarius.io/vsociety/posts/pwnkit-pkexec-lpe-cve-2021-4034 Exploit,Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-4034 US Government Resource

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Command Center by Starwindsoftware

Enterprise Linux by Redhat

Enterprise Linux Desktop by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux For Ibm Z Systems by Redhat

Enterprise Linux For Ibm Z Systems by Redhat

Enterprise Linux For Ibm Z Systems Eus by Redhat

Enterprise Linux For Ibm Z Systems Eus by Redhat

Enterprise Linux For Power Big Endian by Redhat

Enterprise Linux For Power Little Endian by Redhat

Enterprise Linux For Power Little Endian by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux For Scientific Computing by Redhat

Enterprise Linux Server by Redhat

Enterprise Linux Server by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Eus by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Server Update Services For Sap Solutions by Redhat

Enterprise Linux Server Update Services For Sap Solutions by Redhat

Enterprise Linux Server Update Services For Sap Solutions by Redhat

Enterprise Linux Server Update Services For Sap Solutions by Redhat

Enterprise Linux Server Update Services For Sap Solutions by Redhat

Enterprise Linux Workstation by Redhat

Enterprise Storage by Suse

Http Server by Oracle

Http Server by Oracle

Linux Enterprise Desktop by Suse

Linux Enterprise High Performance Computing by Suse

Linux Enterprise Server by Suse

Linux Enterprise Server by Suse

Linux Enterprise Workstation Extension by Suse

Manager Proxy by Suse

Manager Server by Suse

Polkit by Polkit Project

Scalance Lpe9403 Firmware by Siemens

Sinumerik Edge by Siemens

Starwind Virtual San by Starwindsoftware

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

Ubuntu Linux by Canonical

Zfs Storage Appliance Kit by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Remove SUID bit from pkexec

Temporary mitigation via chmod 0

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export