CVE-2021-4034

Red Hat Polkit: Out-of-Bounds Read and Write

As of , CVE-2021-4034 in Red Hat Polkit is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 27 June 2022
US federal deadline
18 July 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
KnownCISA changed it from Unknown to Known on 14 August 2026.
EPSS score
0.94Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.09 on 27 June 2022EPSS on the day CISA listed it.
Public exploit
1 Metasploit module and 1 Exploit-DB entry
Fix
No vendor link in CISA's entry

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.

CISA's description

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

The CVE record's description, from redhat

CVE published
28 January 2022
Assigned by
redhat
CVSS
7.8 High (CVSS 3.1, from CISA-ADP)
CWE-787
Out-of-bounds Write
CISA SSVC, exploitation
active
CISA SSVC, automatable
no
CISA SSVC, technical impact
total

Timeline

  1. Exploit-DB published an exploit (EDB-ID 50689).
  2. The CVE record was published.
  3. CISA added it to its list of exploited vulnerabilities.
  4. The US federal deadline to fix it.
  5. CISA changed its entry. Ransomware use: Unknown to Known.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

Polkit: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2021-3560Incorrect AuthorizationRed Hat PolkitPatch this weekMetasploit module; verified Exploit-DB entry0.24

Read further