Security News > 2022 > January > Linux system service bug gives root on all major distros, exploit released
A vulnerability in Polkit's pkexec component identified as CVE-2021-4034 is present in the default configuration of all major Linux distributions and can be exploited to gain full root privileges on the system, researchers warn today.
Researchers at Qualys information security company found that the pkexec program could be used by local attackers to increase privileges to root on default installations of Ubuntu, Debian, Fedora, and CentOS. They warn that PwnKit is likely exploitable on other Linux operating systems as well.
Bharat Jogi, Director of Vulnerability and Threat Research at Qualys explains that PwnKit is "a memory corruption vulnerability in Polkit's, which allows any unprivileged user to gain full root privileges on a vulnerable system using default polkit configuration,".
BleepingComputer has compiled and tested the available exploit, which proved to be reliable as it gave us root privileges on the system on all attempts.
Linux distros had access to the patch a couple of weeks before today's coordinated disclosure from Qualys and are expected to release updated pkexec packages starting today.
The bug had been present for seven years, since version 0.113 of the component and affected popular Linux distros including RHEL 8, Fedora 21, Ubuntu 20.04, and unstable versions of Debian and its derivatives.
News URL
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-01-28 | CVE-2021-4034 | Out-of-bounds Write vulnerability in multiple products A local privilege escalation vulnerability was found on polkit's pkexec utility. | 7.8 |