CVE-2021-4034
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
Published Jan 28, 2022 · updated Aug 14, 2026 · polkit project polkit
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
Timeline
Detection, updates, and resolution for this record.
Jan 28, 2022 · Catalog
Detected
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this
Jun 27, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jul 18, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Aug 14, 2026 · Catalog
Updated
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this
Required action
Apply updates per vendor instructions.
CISA due date Jul 18, 2022
Affected
- cpe canonical/ubuntu linux14.04
- cpe oracle/http server12.2.1.3.0
- cpe polkit project/polkitversion unspecified
- cpe redhat/enterprise linux8.0
- cpe redhat/enterprise linux desktop7.0
- cpe redhat/enterprise linux eus8.2
- cpe redhat/enterprise linux for ibm z systems7.0
- cpe redhat/enterprise linux for ibm z systems8.0
- cpe redhat/enterprise linux server update services for sap solutions7.6
- cpe redhat/enterprise linux server update services for sap solutions7.7
- cpe siemens/sinumerik edgeversion unspecified
- cpe suse/enterprise storage7.0
- vendor Red Hat Polkitversion unspecified
Sources
- CISA KEVCVE-2021-4034
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
cisa.gov - CVE.orgCVE-2021-4034
Official CVE identifier
cve.org - FIRST EPSSCVE-2021-4034
30-day exploitation probability 94.9%
first.org - Exploit Database50689
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_linux/local/cve_2021_4034_pwnkit_lpe_pkexec
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2021-4034
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the callin
nvd.nist.gov