A vulnerability in Polkit’s pkexec component identified as CVE-2021-4034 (PwnKit) is present in the default configuration of all major Linux distributions and can be exploited to gain full root privileges on the system, researchers warn today.
CVE-2021-4034 has been named PwnKit and its origin has been tracked to the initial commit of pkexec, more than 12 years ago, meaning that all Polkit versions are affected.
Part of the Polkit open-source application framework that negotiates the interaction between privileged and unprivileged processes, pkexec allows an authorized user to execute commands as another user, doubling as an alternative to sudo.
Easy to exploit, PoC expected soon
Researchers at Qualys information security company found that the pkexec program could be used by local attackers to increase privileges to root on default installations of Ubuntu, Debian, Fedora, and CentOS.
They warn that PwnKit is likely exploitable on other Linux operating systems as well.
Bharat Jogi, Director of Vulnerability and Threat Research at Qualys explains that PwnKit is “a memory corruption vulnerability in Polkit’s, which allows any unprivileged user to gain full root privileges on a vulnerable system using default polkit configuration,”
The researcher notes that the issue has been hiding in plain sight since the first version of pkexec inn May 2009. The video below demonstrates the exploitability of the bug:
Exploiting the flaw is so easy, the researchers say, that proof-of-concept (PoC) exploit code is expected to become public in just a few days. The Qualys Research Team will not release a PoC for PwnKit.
Update: An exploit has already emerged in the public space, less than three hours after Qualys published the technical details for PwnKit. BleepingComputer has compiled and tested the available exploit, which proved to be reliable as it gave us root privileges on the system on all attempts.
Referrinng to the exploit, CERT/CC vulnerability analyst Will Dormann said that it is both simple and universal. The researcher further tested it on an ARM64 system, showing that it works on that architecture, too.
Qualys reported the security issue responsibly on November 18, 2021, and waited for a patch to become available before publishing the technical details behind PwnKit.
The company strongly recommends administrators prioritize applying the patches that Polkit’s authors released on their GitLab a couple of hours ago.
Linux distros had access to the patch a couple of weeks before today’s coordinated disclosure from Qualys and are expected to release updated pkexec packages starting today.
Ubuntu has already pushed updates for PolicyKit to address the vulnerability in versions 14.04 and 16.04 ESM (extended security maintenance) as well as in more recent versions 18.04, 20.04, and 21.04. Users just need to run a standard system update and then reboot the computer for the changes to take effect.
Red Hat has also delivered a security update for polkit on Workstation and on Enterprise products for supported architectures, as well as for extended life cycle support, TUS, and AUS.
A temporary mitigation for operating systems that have yet to push a patch is to strip pkexec of the read/write rights with the following command:
chmod 0755 /usr/bin/pkexec“Users that want to look for signs of PwnKit exploitation can do it by checking the logs for either “The value for the SHELL variable was not found the /etc/shells file” or “The value for environment variable […] contains suspicious content.” entries.
However, Qualys notes that exploiting PwnKit is possible without leaving a trace.
Last year, GitHub Security Lab researcher Kevin Backhouse discovered another old privilege escalation vulnerability affecting Polkit.
The bug had been present for seven years, since version 0.113 of the component and affected popular Linux distros including RHEL 8, Fedora 21 (or later), Ubuntu 20.04, and unstable versions of Debian (‘bullseye’) and its derivatives.
Update [January 25, 17:26 EST]: Added security notices on PolicyKit / Polkit from Ubuntu and Red Hat.
Update [January 25, 17:43 EST]: Article updated with information about proof-of-concept exploit code being publicly available.
