HIGH🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2021-4034

CVSS 7.8v3.1pub. 2022-01-28upd. 2026-08-15

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Canonical Ubuntu
OS
Canonical
14.0416.0418.0420.0421.10
Oracle HTTP Server
APP
Oracle
12.2.1.3.012.2.1.4.0
Oracle Zfs Storage Appliance Kit
APP
Oracle
8.8
Polkit Project Polkit
APP
Polkit Project
< 121
Red Hat Enterprise Linux
OS
Redhat
8.0
Red Hat Enterprise Linux Desktop
OS
Redhat
7.0
Red Hat Enterprise Linux Eus
OS
Redhat
8.2
Red Hat Enterprise Linux For IBM Z Systems
OS
Redhat
7.08.0
Red Hat Enterprise Linux For IBM Z Systems Eus
OS
Redhat
8.28.4
Red Hat Enterprise Linux For Power Big Endian
OS
Redhat
7.0
Red Hat Enterprise Linux For Power Little Endian
OS
Redhat
7.08.0
Red Hat Enterprise Linux For Power Little Endian Eus
OS
Redhat
8.18.28.4
Red Hat Enterprise Linux For Scientific Computing
OS
Redhat
7.0
Red Hat Enterprise Linux Server
OS
Redhat
6.07.0
Red Hat Enterprise Linux Server Aus
OS
Redhat
7.37.47.67.78.28.4
Red Hat Enterprise Linux Server Eus
OS
Redhat
8.4
Red Hat Enterprise Linux Server Tus
OS
Redhat
7.67.78.28.4
Red Hat Enterprise Linux Server Update Services For Sap Solutions
APP
Redhat
7.67.78.18.28.4
Red Hat Enterprise Linux Workstation
OS
Redhat
7.0
Siemens Scalance Lpe9403
HW
Siemens
all versions
Siemens Scalance Lpe9403 Firmware
OS
Siemens
< 2.0
Siemens Sinumerik Edge
APP
Siemens
< 3.3.0
Starwindsoftware Command Center
APP
Starwindsoftware
1.0
Starwindsoftware Starwind Virtual San
APP
Starwindsoftware
v8
SUSE Enterprise Storage
APP
Suse
7.0
SUSE Linux Enterprise Desktop
OS
Suse
15
SUSE Linux Enterprise High Performance Computing
APP
Suse
15.0
SUSE Linux Enterprise Server
OS
Suse
15
SUSE Linux Enterprise Workstation Extension
OS
Suse
12
SUSE Manager Proxy
APP
Suse
4.1

CISA KEV — detailsi

Vendori: Red Hat ↗
Producti: Polkit
Added to KEVi: June 27, 2022
Remediation deadline (US Federal)i: July 18, 2022(overdue)
Ransomwarei: Active ransomware campaigns exploit this vulnerability

🔧Advisory Red Hat↗🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.

🔴