HIGH🚩 CISA KEV⚡ EXPLOIT🇬🇧 English

CVE-2021-4034

CVSS 7.8v3.1pub. 2022-01-28upd. 2025-11-06

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

oryginał EN

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Canonical Ubuntu
OS
Canonical
14.0416.0418.0420.0421.10
Oracle HTTP Server
APP
Oracle
12.2.1.3.012.2.1.4.0
Oracle Zfs Storage Appliance Kit
APP
Oracle
8.8
Polkit Project Polkit
APP
Polkit Project
< 121
Red Hat Enterprise Linux
OS
Redhat
8.0
Red Hat Enterprise Linux Desktop
OS
Redhat
7.0
Red Hat Enterprise Linux Eus
OS
Redhat
8.2
Red Hat Enterprise Linux For IBM Z Systems
OS
Redhat
7.08.0
Red Hat Enterprise Linux For IBM Z Systems Eus
OS
Redhat
8.28.4
Red Hat Enterprise Linux For Power Big Endian
OS
Redhat
7.0
Red Hat Enterprise Linux For Power Little Endian
OS
Redhat
7.08.0
Red Hat Enterprise Linux For Power Little Endian Eus
OS
Redhat
8.18.28.4
Red Hat Enterprise Linux For Scientific Computing
OS
Redhat
7.0
Red Hat Enterprise Linux Server
OS
Redhat
6.07.0
Red Hat Enterprise Linux Server Aus
OS
Redhat
7.37.47.67.78.28.4
Red Hat Enterprise Linux Server Eus
OS
Redhat
8.4
Red Hat Enterprise Linux Server Tus
OS
Redhat
7.67.78.28.4
Red Hat Enterprise Linux Server Update Services For Sap Solutions
APP
Redhat
7.67.78.18.28.4
Red Hat Enterprise Linux Workstation
OS
Redhat
7.0
Siemens Scalance Lpe9403
HW
Siemens
wszystkie wersje
Siemens Scalance Lpe9403 Firmware
OS
Siemens
< 2.0
Siemens Sinumerik Edge
APP
Siemens
< 3.3.0
Starwindsoftware Command Center
APP
Starwindsoftware
1.0
Starwindsoftware Starwind Virtual San
APP
Starwindsoftware
v8
SUSE Enterprise Storage
APP
Suse
7.0
SUSE Linux Enterprise Desktop
OS
Suse
15
SUSE Linux Enterprise High Performance Computing
APP
Suse
15.0
SUSE Linux Enterprise Server
OS
Suse
15
SUSE Linux Enterprise Workstation Extension
OS
Suse
12
SUSE Manager Proxy
APP
Suse
4.1

CISA KEV — szczegółyi

Dostawcai: Red Hat ↗
Produkti: Polkit
Data dodania do KEVi: 27 czerwca 2022
Termin remediation (USA)i: 18 lipca 2022(po terminie)

🔧Advisory Red Hat↗🇺🇸CISA KEV (oryginał)↗

Wymagana akcja (CISA)i

Zastosuj aktualizacje zgodnie z instrukcjami producenta.

tłumaczenie AI

▸ Pokaż oryginał (EN)

Apply updates per vendor instructions.

Opis CISAi

Narzędzie Red Hat polkit pkexec zawiera lukę typu out-of-bounds read and write, która umożliwia eskalację uprawnień do poziomu administratora.

tłumaczenie AI

▸ Pokaż oryginał (EN)

The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.

🔴