Red Hat · Polkit
The flaw lies in Polkit's pkexec utility, a setuid tool that lets unprivileged users run commands as privileged users under predefined policies; it mishandles the calling parameter count and ends up attempting to execute environment variables as commands. A local attacker with low privileges and no user interaction can craft environment variables that cause pkexec to run arbitrary code, escalating to administrative rights on the affected machine.
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
First seen exploited 4 months after disclosure. Public exploit code (PoC-in-GitHub) was available 3 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
The Polkit/Pwnkit vulnerability (CVE-2021-4034) is a critical vulnerability impacting every major Linux distribution. Its attack vector allows privilege escalation and can even give the attacker root access.
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2021-4034 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
…via Impacket toolkit Suspicious PowerShell command line Suspicious WMI process creation Microsoft Defender Vulnerability Management Microsoft Defender Vulnerability Management surfaces devices that may be affected by the following vulnerabilities used in this threat: CVE-2021-26084 CVE-2020-1472 CVE-2021-4034…
…scripts for, but not exploiting, the following CVEs: CVE-2020-1472 (Microsoft: Windows Server) CVE-2021-26084 (Atlassian Confluence Server and Data Center) CVE-2021-3156 (Red Hat: Privilege Escalation via Command Line Argument Parsing) CVE-2021-4034 (Red Hat: Polkit Privilege…
2 passages name itOriginal (opens in a new tab) ↗
PWNKIT Exploit PWNKIT is an implementation of CVE-2021-4034, used for privilege escalation.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.