Polkit

wikipedia:Polkit Authorization Framework

https://linux.die.net/man/8/polkit

• pkexec command included in policykit-1 package
• PwnKit (CVE-2021-4034), CVSS: High severity

Vulnerability

A memory corruption vulnerability PwnKit (CVE-2021-4034) discovered in the pkexec command (installed on all major Linux distributions) was announced on January 25, 2022. The vulnerability dates back to the original distribution from 2009. The vulnerability received a CVSS score of 7.8 ("High severity") reflecting serious factors involved in a possible exploit: unprivileged users can gain full root privileges, regardless of the underlying machine architecture or whether the polkit daemon is running or not.

Related

• Qualys

See also

• Polkit, polkitd
• Polkit, Policykit-1, pkexec
• sudo, doas, Polkit (pkexec)

"CVE listing for CVE-2021-4034". Mitre. Retrieved January 25, 2022.

"PwnKit: Local Privilege Escalation Vulnerability Discovered in polkit's pkexec (CVE-2021-4034)". Qualys. January 25, 2022. Retrieved January 25, 2022.

"Major Linux PolicyKit security vulnerability uncovered: Pwnkit". ZDNet. January 25, 2022. Retrieved January 25, 2022.