Security bulletin | Linux Polkit privilege escalation vulnerability (CVE-2021-4034) -

A local privilege escalation vulnerability has been discovered in Polkit's pkexec program. The program improperly handles command-line parameters, creating a risk of local privilege escalation through parameter injection.

Vulnerability information

Vulnerability ID: CVE-2021-4034
Vulnerability Severity: High
Affected Scope: All major Linux distributions

Details

This is a memory corruption vulnerability in pkexec, a SUID-root program that is part of Polkit and installed on all major Linux distributions. The program allows a non-privileged user to run commands as a privileged user based on predefined policies. The current version of pkexec does not correctly handle command-line parameters. This flaw allows an attacker to manipulate environment variables to induce pkexec to execute arbitrary code. Successful exploitation of this vulnerability grants a non-privileged user full root privileges.

Remediation

The Polkit packages in Anolis OS and Alibaba Cloud Linux have been updated to secure versions. The version details are as follows:

Anolis OS 7: polkit-0.112-26.an7.1
Anolis OS 8: polkit-0.115-13.an8_5.1
Alibaba Cloud Linux 2: polkit-0.112-26.3.al7.1
Alibaba Cloud Linux 3: polkit-0.115-13.al8.1

Other Linux distribution vendors have also released security patches. We recommend that you upgrade Polkit to a secure version as soon as possible. For official security notices from Ubuntu, Red Hat, CentOS, and Debian, see the following:

Below are example upgrade commands for some operating systems:

To upgrade Polkit on CentOS, run the following command:
```
yum clean all && yum makecache && yum update polkit -y
```
After the upgrade, run the following command to verify the Polkit version.
```
rpm -qa polkit
```
To upgrade Polkit on Ubuntu, run the following command:
```
sudo apt-get update && sudo apt-get install policykit-1
```
After the upgrade, run the following command to verify the Polkit version.
```
dpkg -l policykit-1
```

References

Announced by

Alibaba Cloud Computing Co., Ltd.