# CVE-2021-4034: polkit - Privilege Escalation

> Live exploitation tracking for CVE-2021-4034 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-4034

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.8
- **Public exploit available:** Yes
- **Affected products:** polkit pkexec
- **Weaknesses:** CWE-125 (Out-of-bounds Read); CWE-787 (Out-of-bounds Write)

## Description

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

## CrowdSec analysis

[CVE-2021-4034](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-4034) is a Privilege Escalation vulnerability affecting polkit's pkexec utility. An attacker can exploit this vulnerability to gain administrative rights on the target machine.

CrowdSec has been tracking this vulnerability and its exploits since 27th of January 2022.

CrowdSec has not observed any significant exploitation activity targeting CVE-2021-4034 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Exploitation targets the `pkexec` utility, which is a setuid tool designed to allow unprivileged users to run commands as privileged users according to predefined policies.

## Timeline

- 2022-01-27: Rule Released. CrowdSec releases a rule to detect CVE-2021-4034 exploitation attempts against the CrowdSec Network.
- 2022-01-28: CVE Published. CVE-2021-4034 is published to NVD.
- 2022-06-27: CISA KEV. CVE-2021-4034 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-07-18: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-09-21: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-4034 for the first time.

## References

- https://access.redhat.com/security/vulnerabilities/RHSB-2022-001
- https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
- https://bugzilla.redhat.com/show_bug.cgi?id=2025869
- https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.suse.com/support/kb/doc/?id=000020564
- https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf
- https://www.starwindsoftware.com/security/sw-20220818-0001/
- https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-4034) follows observed exploitation activity for CVE-2021-4034. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.