CVE-2021-4034 Red Hat Polkit Out-of-Bounds Read and Write

Exploited in the wild High 7.8 Published 28 Jan 2022 Updated 15 Aug 2026

Local attackers can exploit a memory corruption flaw in pkexec to execute arbitrary code and gain root privileges on Linux systems.

Exploited in the wild: Since 27 Jun 2022
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-4034?

CVE-2021-4034 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 28 Jan 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

Weakness: CWE-125, CWE-787

Which versions are affected by CVE-2021-4034?

It affects 30 products.

Linux distribution packages (40)

`polkit` AlmaLinux:8	All versions	`0.115-13.el8_5.2`
`polkit-devel` AlmaLinux:8	All versions	`0.115-13.el8_5.2`
`polkit-docs` AlmaLinux:8	All versions	`0.115-13.el8_5.2`
`polkit-libs` AlmaLinux:8	All versions	`0.115-13.el8_5.2`
`polkit` Red Hat:enterprise_linux:7::client	All versions	`0:0.112-26.el7_9.1`
`polkit-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:0.112-26.el7_9.1`
`polkit-devel` Red Hat:enterprise_linux:7::client	All versions	`0:0.112-26.el7_9.1`
`polkit-docs` Red Hat:enterprise_linux:7::client	All versions	`0:0.112-26.el7_9.1`
`polkit-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:0.112-26.el7_9.1`
`polkit-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:0.112-26.el7_9.1`
`polkit-docs` Red Hat:enterprise_linux:7::computenode	All versions	`0:0.112-26.el7_9.1`
`polkit` Red Hat:enterprise_linux:7::server	All versions	`0:0.112-26.el7_9.1`
`polkit-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:0.112-26.el7_9.1`
`polkit-devel` Red Hat:enterprise_linux:7::server	All versions	`0:0.112-26.el7_9.1`
`polkit-docs` Red Hat:enterprise_linux:7::server	All versions	`0:0.112-26.el7_9.1`
`polkit` Red Hat:enterprise_linux:7::workstation	All versions	`0:0.112-26.el7_9.1`
`polkit-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:0.112-26.el7_9.1`
`polkit-devel` Red Hat:enterprise_linux:7::workstation	All versions	`0:0.112-26.el7_9.1`
`polkit-docs` Red Hat:enterprise_linux:7::workstation	All versions	`0:0.112-26.el7_9.1`
`polkit` Red Hat:enterprise_linux:8::baseos	All versions	`0:0.115-13.el8_5.1`
`polkit-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:0.115-13.el8_5.1`
`polkit-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:0.115-13.el8_5.1`
`polkit-devel` Red Hat:enterprise_linux:8::baseos	All versions	`0:0.115-13.el8_5.1`
`polkit-docs` Red Hat:enterprise_linux:8::baseos	All versions	`0:0.115-13.el8_5.1`
`polkit-libs` Red Hat:enterprise_linux:8::baseos	All versions	`0:0.115-13.el8_5.1`
`polkit-libs-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:0.115-13.el8_5.1`
`polkit` Red Hat:rhel_aus:7.3::server	All versions	`0:0.112-12.el7_3.1`
`polkit-debuginfo` Red Hat:rhel_aus:7.3::server	All versions	`0:0.112-12.el7_3.1`
`polkit-devel` Red Hat:rhel_aus:7.3::server	All versions	`0:0.112-12.el7_3.1`
`polkit-docs` Red Hat:rhel_aus:7.3::server	All versions	`0:0.112-12.el7_3.1`
`polkit` Red Hat:rhel_aus:7.4::server	All versions	`0:0.112-12.el7_4.2`
`polkit-debuginfo` Red Hat:rhel_aus:7.4::server	All versions	`0:0.112-12.el7_4.2`
`polkit-devel` Red Hat:rhel_aus:7.4::server	All versions	`0:0.112-12.el7_4.2`
`polkit-docs` Red Hat:rhel_aus:7.4::server	All versions	`0:0.112-12.el7_4.2`
`polkit` Red Hat:rhel_aus:7.6::server	All versions	`0:0.112-18.el7_6.3`
`polkit-debuginfo` Red Hat:rhel_aus:7.6::server	All versions	`0:0.112-18.el7_6.3`
`polkit-devel` Red Hat:rhel_aus:7.6::server	All versions	`0:0.112-18.el7_6.3`
`polkit-docs` Red Hat:rhel_aus:7.6::server	All versions	`0:0.112-18.el7_6.3`
`polkit` Red Hat:rhel_aus:7.7::server	All versions	`0:0.112-22.el7_7.2`
`polkit-debuginfo` Red Hat:rhel_aus:7.7::server	All versions	`0:0.112-22.el7_7.2`

Products include Canonical Ubuntu Linux, Oracle Http Server, Oracle Zfs Storage Appliance Kit, Polkit Project Polkit, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop and 24 more.

How do I fix CVE-2021-4034?

Apply the vendor's patch. US federal agencies must fix it by 18 Jul 2022.

Is CVE-2021-4034 being exploited?

Yes. Attackers have exploited CVE-2021-4034 in the wild since at least 27 Jun 2022, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 183 proofs of concept on GitHub.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALSA-2022:0267, AZL-8335, CLSA-2022-1643211736, CLSA-2022-1643211885, CLSA-2022-1643211942, CLSA-2022-1643212149 and 26 more.