PwnKit: CVE-2021-4034 in polkit

pkexec from polkit executes environment variables as commands and makes any local account root.

Published in the NVD on 28/01/2022

CVE-2021-4034

CVSS 3.1: 7.8 (high) actively exploited

In the CISA catalogue of actively exploited vulnerabilities since 27/06/2022

Exploitation probability (EPSS, 01/11/2026): 94.921 %, percentile 99.860

What is PwnKit?

PwnKit is a local privilege escalation in pkexec, part of polkit. pkexec is a setuid tool that lets unprivileged users run commands as privileged users according to predefined policies. It does not handle the count of its calling parameters correctly and ends up trying to execute environment variables as commands. A local attacker can craft environment variables so that pkexec executes arbitrary code.

The NVD rates it at CVSS 7.8, and CISA has listed it as actively exploited since 27 June 2022. The NVD lists polkit versions before 121.

Affected and fixed versions

polkit

Affected: < 121

Fixed in 121

Status in Debian and Ubuntu

Debian 12: policykit-1

Fixed

Fixed from package version 0.105-31.1

Debian 13: policykit-1

Fixed

Fixed from package version 0.105-31.1

Ubuntu 20.04 LTS: policykit-1

Fixed

Fixed from package version 0.105-26ubuntu1.2

Ubuntu 22.04 LTS: policykit-1

Fixed

Fixed from package version 0.105-31ubuntu1

What to do

Install the polkit update of your distribution; Debian 12 and 13 already ship packages with the fix.

Erseni Patch tells you when a new vulnerability affects exactly your version, and when your release branch loses its support. Add the program or package with your version and we check it right away.

Watch policykit-1 (Debian 12)

Watch policykit-1 (Ubuntu 22.04 LTS)

Already have an account? Log in and add policykit-1 (Debian 12)