Exploited in the wild · polkit (pkexec) · CVSS 7.8 · published 28 January 2022
PwnKit: CVE-2021-4034
A memory corruption flaw in polkit's pkexec that lets any local user gain root. It had been there since pkexec's first release in 2009. Below is its status on each Linux distribution past end of life, from the vendors' own security trackers.
- 3end-of-life systems without a free fix
- 6fixed or not affected
PwnKit on end-of-life Linux
| Distribution | Status | Details |
|---|---|---|
| CentOS 6 | No free fix | Red Hat fixed it on 25 January 2022, after this release's end of life |
| CentOS 7 | Fixed | polkit 0.112-26.el7_9.1, 25 January 2022 |
| RHEL 7 | Fixed | polkit 0.112-26.el7_9.1, 25 January 2022 |
| CentOS 8 | No free fix | Red Hat fixed it on 25 January 2022, after this release's end of life |
| Ubuntu 16.04 | Fixed only in Ubuntu Pro | 0.105-14.1ubuntu0.5+esm1 |
| Ubuntu 18.04 | Fixed | 0.105-20ubuntu0.18.04.6 |
| Ubuntu 20.04 | Fixed | 0.105-26ubuntu1.2 |
| Debian 10 | Fixed | 0.105-25+deb10u1, DSA-5059-1 |
| Debian 11 | Fixed | 0.105-31+deb11u1, DSA-5059-1 |
From the Red Hat security data (CentOS and RHEL), the Ubuntu CVE tracker and the Debian security tracker, 29 October 2026. CentOS received Red Hat's fixes only until its own end of life; later fixes went to paid Red Hat support. Fixes marked Ubuntu Pro need a paid subscription. Where a tracker has no entry, the version in the distribution's repository is checked against the NVD range.
What the NVD record says
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
Score 7.8 (High), published 28 January 2022. Listed in the CISA catalogue of known exploited vulnerabilities on 27 June 2022. Read the NVD entry
Affected upstream versions of polkit (pkexec)
- polkit before 121
What you can do
Keep polkit (pkexec), patched
Where the table shows no free fix, we backport it to the package you run, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported release once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.