Description
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | polkit | all | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | policykit-1 | 0.105-31.1 | — |
| Debian 13 | policykit-1 | 0.105-31.1 | — |
| Debian 12 | policykit-1 | 0.105-31.1 | — |
| Debian 11 | policykit-1 | 0.105-31+deb11u1 | DSA-5059-1 |
| Debian 10 | policykit-1 | 0.105-25+deb10u1 | DSA-5059-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | policykit-1 | 0.105-18+deb9u2 | DLA-2899-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | policykit-1 | 0.105-31ubuntu1 | — |
| Ubuntu 20.04 LTS | policykit-1 | 0.105-26ubuntu1.2 | USN-5252-1 |
| Ubuntu 18.04 LTS | policykit-1 | 0.105-20ubuntu0.18.04.6 | USN-5252-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | policykit-1 | 0.105-14.1ubuntu0.5+esm1 | USN-5252-2 |
| Ubuntu Pro 14.04 LTS | policykit-1 | 0.105-4ubuntu3.14.04.6+esm1 | USN-5252-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | polkit +3 | 0.115-13.el8_5.1 | RHSA-2022:0267 |
| RHEL 7 | polkit +2 | 0.112-26.el7_9.1 | RHSA-2022:0274 |
| RHEL 7 | redhat-virtualization-host +1 | 4.3.21-20220126.0.el7_9 | RHSA-2022:0443 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Hypervisor 4 | redhat-virtualization-host +1 | 4.4.10-202202081536_8.5 | RHSA-2022:0540 |
| RHEL 8.4 EUS | polkit +3 | 0.115-11.el8_4.2 | RHSA-2022:0266 |
| RHEL 8.2 EUS | polkit +3 | 0.115-11.el8_2.2 | RHSA-2022:0265 |
| RHEL 8.1 E4S | polkit +3 | 0.115-9.el8_1.2 | RHSA-2022:0268 |
| RHEL 7.7 TUS | polkit +2 | 0.112-22.el7_7.2 | RHSA-2022:0273 |
| RHEL 7.7 E4S | polkit +2 | 0.112-22.el7_7.2 | RHSA-2022:0273 |
| RHEL 7.7 AUS | polkit +2 | 0.112-22.el7_7.2 | RHSA-2022:0273 |
| RHEL 7.6 TUS | polkit +2 | 0.112-18.el7_6.3 | RHSA-2022:0271 |
| RHEL 7.6 E4S | polkit +2 | 0.112-18.el7_6.3 | RHSA-2022:0271 |
| RHEL 7.6 AUS | polkit +2 | 0.112-18.el7_6.3 | RHSA-2022:0271 |
| RHEL 7.4 AUS | polkit +2 | 0.112-12.el7_4.2 | RHSA-2022:0272 |
| RHEL 7.3 AUS | polkit +2 | 0.112-12.el7_3.1 | RHSA-2022:0270 |
| RHEL 6 ELS | polkit +3 | 0.96-11.el6_10.2 | RHSA-2022:0269 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | polkit +3 | 0.115-13.el8_5.2 | ALSA-2022:0267 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | polkit | 0.115-13.el8_5.1 | RLSA-2022:0267 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | polkit | 0.116-3.6.1 | SUSE-SU-2022:0190-1 |
| SLES 15 SP2 | polkit | 0.116-3.6.1 | SUSE-SU-2022:0190-1 |
| SLES 15 SP1 | polkit | 0.114-3.15.1 | SUSE-SU-2022:0191-1 |
| SLES 15 | polkit | 0.114-3.15.1 | SUSE-SU-2022:0191-1 |
| SLES 12 SP5 | polkit | 0.113-5.24.1 | SUSE-SU-2022:0189-1 |
Show 24 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | polkit | 0.113-5.24.1 | SUSE-SU-2022:0189-1 |
| SLES 12 SP3 | polkit | 0.113-5.24.1 | SUSE-SU-2022:0189-1 |
| SLES 12 SP2 | polkit | 0.113-5.24.1 | SUSE-SU-2022:0189-1 |
| SLES for SAP 15 SP2 | polkit | 0.116-3.6.1 | SUSE-SU-2022:0190-1 |
| SLES for SAP 15 SP1 | polkit | 0.114-3.15.1 | SUSE-SU-2022:0191-1 |
| SLES for SAP 15 | polkit | 0.114-3.15.1 | SUSE-SU-2022:0191-1 |
| SLES for SAP 12 SP5 | polkit | 0.113-5.24.1 | SUSE-SU-2022:0189-1 |
| SLES for SAP 12 SP4 | polkit | 0.113-5.24.1 | SUSE-SU-2022:0189-1 |
| SLES for SAP 12 SP3 | polkit | 0.113-5.24.1 | SUSE-SU-2022:0189-1 |
| SLE Micro 5.1 | polkit | 0.116-3.6.1 | SUSE-SU-2022:0190-1 |
| SLE Micro 5.0 | polkit | 0.116-3.6.1 | SUSE-SU-2022:0190-1 |
| SLE HPC 15 SP2 | polkit | 0.116-3.6.1 | SUSE-SU-2022:0190-1 |
| SLE HPC 15 SP1 | polkit | 0.114-3.15.1 | SUSE-SU-2022:0191-1 |
| SLE HPC 15 | polkit | 0.114-3.15.1 | SUSE-SU-2022:0191-1 |
| SUSE OpenStack Cloud Crowbar 9 | polkit | 0.113-5.24.1 | SUSE-SU-2022:0189-1 |
| SUSE OpenStack Cloud Crowbar 8 | polkit | 0.113-5.24.1 | SUSE-SU-2022:0189-1 |
| SUSE OpenStack Cloud 9 | polkit | 0.113-5.24.1 | SUSE-SU-2022:0189-1 |
| SUSE OpenStack Cloud 8 | polkit | 0.113-5.24.1 | SUSE-SU-2022:0189-1 |
| SUSE Manager Server 4.1 | polkit | 0.116-3.6.1 | SUSE-SU-2022:0190-1 |
| SUSE Manager Retail Branch Server 4.1 | polkit | 0.116-3.6.1 | SUSE-SU-2022:0190-1 |
| SUSE Manager Proxy 4.1 | polkit | 0.116-3.6.1 | SUSE-SU-2022:0190-1 |
| SUSE HPE Helion OpenStack 8 | polkit | 0.113-5.24.1 | SUSE-SU-2022:0189-1 |
| SUSE Enterprise Storage 7 | polkit | 0.116-3.6.1 | SUSE-SU-2022:0190-1 |
| SUSE Enterprise Storage 6 | polkit | 0.114-3.15.1 | SUSE-SU-2022:0191-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | polkit | 0.120-2.1 | openSUSE-SU-2024:11780-1 |
| openSUSE Leap 15.3 | polkit | 0.116-3.6.1 | openSUSE-SU-2022:0190-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | polkit | 0.120-r2 | — |
| Alpine v3.23 | polkit | 0.120-r2 | — |
| Alpine v3.22 | polkit | 0.120-r2 | — |
| Alpine v3.21 | polkit | 0.120-r2 | — |
| Alpine v3.20 | polkit | 0.120-r2 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | polkit | 0.120-r2 | — |
| Alpine v3.18 | polkit | 0.120-r2 | — |
| Alpine v3.17 | polkit | 0.120-r2 | — |
| Alpine v3.16 | polkit | 0.120-r2 | — |
| Alpine v3.15 | polkit | 0.119-r8 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | polkit +3 | 0.117-10.amzn2023.0.3 | ALAS2023-2023-026 |
| Amazon Linux 2 | polkit +2 | 0.112-26.amzn2.1 | ALAS2-2022-1745 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | polkit | 0.119-2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | polkit +3 | 0.115-13.0.1.el8_5.1 | ELSA-2022-0267 |
| Oracle Linux 7 | polkit +2 | 0.112-26.0.1.el7_9.1 | ELSA-2022-0274 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Local Privilege Escalation in polkits pkexec
exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec
Exploit-DB 1
- PolicyKit-1 0.105-31 - Privilege Escalation EDB-50689 · local · Jan 27, 2022
GitHub 185 repositories · most starred shown
-
berdav/CVE-2021-4034 ★ 2,048 · Jan 25, 2022
CVE-2021-4034 1day
-
ly4k/PwnKit ★ 1,340 · Jan 26, 2022
Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation
-
arthepsy/CVE-2021-4034 ★ 1,177 · Jan 26, 2022
PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)
-
PwnFunction/CVE-2021-4034 ★ 354 · Jan 27, 2022
Proof of concept for pwnkit vulnerability
-
joeammond/CVE-2021-4034 ★ 178 · Jan 26, 2022
Python exploit code for CVE-2021-4034 (pwnkit)
-
dzonerzy/poc-cve-2021-4034 ★ 114 · Jan 26, 2022
PoC for CVE-2021-4034 dubbed pwnkit
-
luijait/PwnKit-Exploit ★ 99 · Jan 26, 2022
Proof of Concept (PoC) CVE-2021-4034
-
Rvn0xsy/CVE-2021-4034 ★ 96 · Jan 28, 2022
CVE-2021-4034 Add Root User - Pkexec Local Privilege Escalation
-
Ayrx/CVE-2021-4034 ★ 91 · Jan 26, 2022
Exploit for CVE-2021-4034
-
EstamelGG/CVE-2021-4034-NoGCC ★ 78 · Jan 28, 2022
CVE-2021-4034简单优化，以应对没有安装gcc和make的目标环境
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 37
- ALSA-2022:0267 Important: polkit security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2022-0432 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2022-0302 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Oct 11, 2026
- RHSA-2022:0540 Red Hat Security Advisory: Red Hat Virtualization Host security update [ovirt-4.4.10-1] Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2022:0443 Red Hat Security Advisory: RHV-H security update (redhat-virtualization-host) 4.3.21 Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2022:0274 Red Hat Security Advisory: polkit security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2022:0272 Red Hat Security Advisory: polkit security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2022:0273 Red Hat Security Advisory: polkit security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2022:0271 Red Hat Security Advisory: polkit security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2022:0270 Red Hat Security Advisory: polkit security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2022:0268 Red Hat Security Advisory: polkit security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2022:0269 Red Hat Security Advisory: polkit security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2022:0266 Red Hat Security Advisory: polkit security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2022:0267 Red Hat Security Advisory: polkit security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2022:0265 Red Hat Security Advisory: polkit security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- USN-5252-2 policykit-1 vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- USN-5252-1 policykit-1 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-5059-1 policykit-1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2899-1 policykit-1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:0267 Important: polkit security update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2022:0190-1 Security update for polkit SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0191-1 Security update for polkit SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0189-1 Security update for polkit SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:0190-1 Security update for polkit SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11780-1 libpolkit-agent-1-0-0.120-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0426 IBM Spectrum Protect: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 6, 2025
- WID-SEC-2022-1483 PolicyKit: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Jan 8, 2024
- SSA-419740 SSA-419740: Multiple Third-Party Component Vulnerabilities in RUGGEDCOM and SCALANCE Products before V7.2 Siemens ProductCERT · Mar 14, 2023
- ICSA-23-075-01 Siemens SCALANCE, RUGGEDCOM Third-Party CISA ICS & IT advisories · Mar 14, 2023
- ALAS2023-2023-026 Important: polkit security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
- ICSA-22-270-02 Hitachi Energy APM Edge CISA ICS & IT advisories · Sep 27, 2022
- SSA-330556 SSA-330556: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034) Siemens ProductCERT · Jun 14, 2022
- ICSA-22-167-16 Siemens SCALANCE LPE 4903 and SINUMERIK Edge CISA ICS & IT advisories · Jun 14, 2022
- SCA-2022-0002 PwnKit vulnerability affects multiple SICK IPCs SICK PSIRT · Feb 23, 2022
- ALAS2-2022-1745 Important: polkit security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 27, 2022
- ELSA-2022-0267 Important: polkit security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 25, 2022
- ELSA-2022-0274 Important: polkit security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 25, 2022
References
- https://access.redhat.com/security/vulnerabilities/RHSB-2022-001
- https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
- https://bugzilla.redhat.com/show_bug.cgi?id=2025869
- https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683
- https://www.oracle.com/security-alerts/cpuapr2022.html
- http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html
- https://www.suse.com/support/kb/doc/?id=000020564
- https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf
- https://www.starwindsoftware.com/security/sw-20220818-0001/
- https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/