{"id":"CVE-2021-4034","published":"2022-01-28T20:15:12Z","modified":"2026-08-15T04:17:57Z","title":"Red Hat Polkit Out-of-Bounds Read and Write Vulnerability","vendor":"Red Hat","product":"Polkit","tier":"core","eol":null,"description":{"text":"A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw lies in Polkit's pkexec utility, a setuid tool that lets unprivileged users run commands as privileged users under predefined policies; it mishandles the calling parameter count and ends up attempting to execute environment variables as commands. A local attacker with low privileges and no user interaction can craft environment variables that cause pkexec to run arbitrary code, escalating to administrative rights on the affected machine.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:54:42Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.94921,"percentile":0.9986,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-06-27","dueDate":"2022-07-18","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-4034","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-06-07","exploitedFirstSeen":"2022-06-07","ransomware":true,"evidence":[{"url":"https://www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/","date":"2022-06-07"},{"url":"https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/","date":"2022-06-15"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-06-27"},{"url":"https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf","date":"2023-02-02"},{"url":"https://decoded.avast.io/threatresearch/avast-q4-2022-threat-report/","date":"2023-02-09"},{"url":"https://cujo.com/blog/the-2022-2023-iot-botnet-report-vulnerabilities-targeted/","date":"2023-04-27"},{"url":"https://cujo.com/the-2022-2023-iot-botnet-report-vulnerabilities-targeted/","date":"2023-04-27"},{"url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/","date":"2023-06-14"},{"url":"https://socradar.io/threat-actor-profile-bianlian-the-shape-shifting-ransomware-group/","date":"2023-07-13"},{"url":"https://sysdig.com/blog/labrat-cryptojacking-proxyjacking-campaign/","date":"2023-08-17"}],"evidenceTotal":47,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"EbeeOct2026 Pt5","url":"https://otx.alienvault.com/pulse/6ae189b2042138c108f4126b","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"AI-Powered Espionage Campaign Targets Government Linux Infrastructure","url":"https://otx.alienvault.com/pulse/6ad9e5f8f96c9a55208cc615","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-125","name":"Out-of-bounds Read"},{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2022-001","tags":["Mitigation","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025869","tags":["Issue Tracking","Patch"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf","tags":["Third Party Advisory"]},{"url":"https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683","tags":["Patch"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.starwindsoftware.com/security/sw-20220818-0001/","tags":["Third Party Advisory"]},{"url":"https://www.suse.com/support/kb/doc/?id=000020564","tags":["Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2022-001","tags":["Mitigation","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025869","tags":["Issue Tracking","Patch"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf","tags":["Third Party Advisory"]},{"url":"https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683","tags":["Patch"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.starwindsoftware.com/security/sw-20220818-0001/","tags":["Third Party Advisory"]},{"url":"https://www.suse.com/support/kb/doc/?id=000020564","tags":["Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/pwnkit-pkexec-lpe-cve-2021-4034","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-4034","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Out-of-Bounds (Read and Write)","mappingType":"exploitation_technique","evidence":[],"comment":"The Polkit/Pwnkit vulnerability (CVE-2021-4034) is a critical vulnerability impacting every major Linux distribution. Its attack vector allows privilege escalation and can even give the attacker root access.","confidence":"high"}],"reports":[{"id":"SRC-622b5f77d51256e536ea","title":"Cadet Blizzard emerges as a novel and distinct Russian threat actor","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/","date":"2023-06-14","mentions":[{"quote":"via Impacket toolkit\n- Suspicious PowerShell command line\n- Suspicious WMI process creation\nMicrosoft Defender Vulnerability Management\nMicrosoft Defender Vulnerability Management surfaces devices that may be affected by the following vulnerabilities used in this threat:\n- CVE-2021-26084\n- CVE-2020-1472\n- CVE-2021-4034","start":20948,"end":21268}]},{"id":"SRC-cb049733b1fc717427aa","title":"Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure","publisher":"cisa.gov","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf","date":null,"mentions":[{"quote":"scripts for, but not exploiting, the following CVEs:\r\n CVE-2020-1472 (Microsoft: Windows Server)\r\n CVE-2021-26084 (Atlassian Confluence Server and Data Center)\r\n CVE-2021-3156 (Red Hat: Privilege Escalation via Command Line Argument Parsing)\r\n CVE-2021-4034 (Red Hat: Polkit Privilege","start":9666,"end":9954},{"quote":" NIST NVD: CVE-2021-4034","start":36936,"end":36961}]},{"id":"SRC-5d2b20805459665b8dca","title":"APT44: Unearthing","publisher":"services.google.com","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf","date":null,"mentions":[{"quote":"PWNKIT Exploit PWNKIT is an implementation of CVE-2021-4034, used for privilege escalation.","start":54826,"end":54917}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-33934","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-33934","exploited":true,"exploitedSince":"2022-06-27","provenance":"source"},"exploits":[{"id":50689,"url":"https://www.exploit-db.com/exploits/50689","title":"PolicyKit-1 0.105-31 - Privilege Escalation","type":"local","platform":"linux","date":"2022-01-27","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2022-01-27"},"pocGithub":{"count":144,"skipped":40,"earliest":"2022-01-25","earliestUrl":"https://github.com/ryaagard/CVE-2021-4034","repos":[{"name":"berdav/CVE-2021-4034","url":"https://github.com/berdav/CVE-2021-4034","stars":2047,"created":"2022-01-25"},{"name":"ly4k/PwnKit","url":"https://github.com/ly4k/PwnKit","stars":1338,"created":"2022-01-26"},{"name":"arthepsy/CVE-2021-4034","url":"https://github.com/arthepsy/CVE-2021-4034","stars":1175,"created":"2022-01-26"},{"name":"PwnFunction/CVE-2021-4034","url":"https://github.com/PwnFunction/CVE-2021-4034","stars":354,"created":"2022-01-27"},{"name":"joeammond/CVE-2021-4034","url":"https://github.com/joeammond/CVE-2021-4034","stars":180,"created":"2022-01-26"}]},"metasploit":[{"name":"Local Privilege Escalation in polkits pkexec","module":"exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec","type":"exploit","disclosureDate":"2022-01-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2021_4034_pwnkit_lpe_pkexec.rb"}],"first":{"date":"2022-01-25","source":"PoC-in-GitHub","url":"https://github.com/ryaagard/CVE-2021-4034"},"provenance":"source"},"detections":{"cveRules":[{"title":"PwnKit Local Privilege Escalation","id":"0506a799-698b-43b4-85a1-ac4c84c720e9","level":"high","status":"test","path":"rules-emerging-threats/2021/Exploits/CVE-2021-4034/lnx_auth_exploit_cve_2021_4034_pwnkit_lpe.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-4034/lnx_auth_exploit_cve_2021_4034_pwnkit_lpe.yml","techniques":["T1548.001"]}]},"exploitRefs":["http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html","https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt","https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/","https://www.vicarius.io/vsociety/posts/pwnkit-pkexec-lpe-cve-2021-4034","http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"source"}],"timeline":[{"date":"2022-01-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2022-01-25, Exploit-DB 2022-01-27","url":"https://github.com/ryaagard/CVE-2021-4034","provenance":"source"},{"date":"2022-01-28","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4034","provenance":"source"},{"date":"2022-06-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/","provenance":"source"},{"date":"2022-06-27","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-06-27","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-33934","provenance":"source"},{"date":"2023-06-14","kind":"report","label":"Named in microsoft.com: Cadet Blizzard emerges as a novel and distinct Russian threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":150},"priority":{"score":86.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1607 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9986"},{"name":"Named in threat reports","points":7.74,"detail":"3 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 NVD references tagged Exploit; 1 Exploit-DB entry; 1 NVD exploit link; 144 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}