CVE-2021-4034

Name of the Vulnerable Software and Affected Versions polkit versions prior to 0.105-25+deb10u1 (buster) polkit versions prior to 0.105-31+deb11u1 (bullseye) polkit (affected versions not specified)

Description A local privilege escalation issue exists in the pkexec utility of polkit, a setuid tool that allows unprivileged users to execute commands as privileged users based on predefined policies. The issue is caused by an out-of-bounds write that occurs when the main function of pkexec processes command-line arguments. Specifically, the application fails to handle the calling parameters count correctly, which can lead it to execute environment variables as commands. An attacker can exploit this by crafting specific environment variables to induce pkexec to execute arbitrary code, granting the unprivileged user administrative or root privileges on the target machine. This memory corruption issue is reliable and architecture-independent.

Recommendations Update polkit to version 0.105-25+deb10u1 or later for the buster distribution. Update polkit to version 0.105-31+deb11u1 or later for the bullseye distribution. As a temporary mitigation, restrict access to the pkexec utility to minimize the risk of local exploitation.