CVE-2021-4034
HIGHCVSS 7.8Known ExploitedCISA Known Exploited Vulnerability
https://nvd.nist.gov/vuln/detail/CVE-2021-4034
Remediation deadline: July 18, 2022
Ransomware use: Known
Description
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
Timeline
Published:January 28th, 2022 8:15 PM
Last modified:August 15th, 2026 4:17 AM
Added to KEV:June 27th, 2022
CVSS Scoring
CVSS v3: 7.8 (HIGH)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2: 7.2
Affected Software
From NVD CPE configuration data
Vendors
polkit_projectredhatcanonicalsuseoraclesiemensstarwindsoftware
Products
polkitenterprise_linux_server_update_services_for_sap_solutionsenterprise_linuxenterprise_linux_desktopenterprise_linux_eusenterprise_linux_for_ibm_z_systemsenterprise_linux_for_ibm_z_systems_eusenterprise_linux_for_power_big_endianenterprise_linux_for_power_little_endianenterprise_linux_for_power_little_endian_eusenterprise_linux_for_scientific_computingenterprise_linux_serverenterprise_linux_server_ausenterprise_linux_server_eusenterprise_linux_server_tusenterprise_linux_workstationubuntu_linuxenterprise_storagelinux_enterprise_high_performance_computingmanager_proxy
References & Reports
Advisories, patches, and third-party reports
- http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.htmlExploit
- http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.htmlThird Party Advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2022-001Mitigation
- https://bugzilla.redhat.com/show_bug.cgi?id=2025869Issue Tracking
- https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdfThird Party Advisory
- https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683Patch
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch
- https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txtExploit
- https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/Exploit
- https://www.starwindsoftware.com/security/sw-20220818-0001/Third Party Advisory
- https://www.suse.com/support/kb/doc/?id=000020564Third Party Advisory
- http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.htmlExploit
- http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.htmlThird Party Advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2022-001Mitigation
- https://bugzilla.redhat.com/show_bug.cgi?id=2025869Issue Tracking
- https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdfThird Party Advisory
- https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683Patch
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch
- https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txtExploit
- https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/Exploit
- https://www.starwindsoftware.com/security/sw-20220818-0001/Third Party Advisory
- https://www.suse.com/support/kb/doc/?id=000020564Third Party Advisory
- https://www.vicarius.io/vsociety/posts/pwnkit-pkexec-lpe-cve-2021-4034Exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-4034US Government Resource
Source: NIST NVD · Data may lag official sources by up to one minute