PwnKit / polkit / pkexec vulnerability (CVE-2021-4034) - cheat-sheet reference guide
Last updated: $Date: 2022/02/01 01:03:31 $ UTC - best effort, validate all for your environment/model before use, unofficial sources may be wrong
by
@TychoTithonus (Royce Williams), standing on the shoulders of many giants
Send updates or suggestions (please include category / context / public (or support-walled) links if you can)
Contents
Key updates
- Issue due to failure to strip unsecure environment variables (pkexec does this similarly to how sudo strips them)
- polkit more likely to be present on desktop-grade systems, less so on "server"-dedicated distro versions
- polkit s an optional port/pkg on FreeBSD, NetBSD, and OpenBSD to support deskto use cases, but not installed in base OS or by default
- Debian and derivatives use a fork of polkit with different version numbering - see GitHub blog
Context - who (and what) is affected
- All Linux with any version of polkit / pkexec - bug was present in initial version
- All major Linux distributions
- Likely most or all downstream projects, appliances, and IoT
- Windows Subsystem for Linux
- Chromebook Linux emulation layer?
Scope / seriousness
- Classic, trivial local privilege escalation - get on the box via any other means, and instantly become root
- Disclosed to vendors on November 18, 2021 by Qualys - vendors coordinating response until January 25
- CVSS 7.8
back to top
Summaries
back to top
Technical analysis
back to top
Background
back to top
Remediation
Direct remediation:
- Apply patches from vendors - this one is pretty simple
Mitigations - official
- Strip setuid bit - see below
Mitigations - easy but may have tradeoffs
- # chmod 0755 /usr/bin/pkexec
- Remove polkit and/or libpolkit (may be feasible for servers)
Mitigations - harder
- If you know you don't need polkit functionality, consider a shell wrapper to trap and log (such as akhepcat's)
Mitigations - ecosystem
back to top
Affected (and unaffected) products
See other product and tool lists if your product is not listed here)
Note: this list focuses primarily on customer-controlled components.
Disclaimer: caching/summaries is best effort and may be out of date or incorrect - always validate for yourself
Claimed patched (previously vulnerable, now remediated/mitigated or updates available)
Confirmed affected - version differences, workarounds suggested, status pending, or not yet analyzed
Claimed unaffected / not vulnerable (no action taken or required)
- BSDs (at the OS level - but see ports below) - there may also be BSD-based appliances, but they're less likely to have OS-based GUIs (as opposed to web GUIs)
- CentOS 7 ?
- Illumos (no pkexec included) - tweet
- macOS (no systemd, no polkit)
- Untangle
Claimed unaffected by default (but configurable to be affected)
Multi-product - vulnerable, mixed, or not yet fully determined
- Almost all Linux-based appliances and platforms likely affected, so individual tracking will be best-effort
- Amazon Linux
- F5 (official)
- NetApp - states "Multiple NetApp product incorporate PolicyKit", but then states "None" for affected products(???)
- VMware - deemed not urgent, due to small footprint (polkit often not present, etc.)
Potentially affected (circumstantially affected, or behind support wall)
Not yet determined, non-commital, or mixed/controversial
- Chrome Linux emulation
- Solaris?
Indirect / integration known
Other rollup lists
back to top
Detection
Finding potentially vulnerable software
Detecting exploitation attempts / threat hunting
- Per Qualys:
Important: this exploitation technique leaves traces in the logs (either
"The value for the SHELL variable was not found the /etc/shells file" or
"The value for environment variable [...] contains suscipious content").
However, please note that this vulnerability is also exploitable without
leaving any traces in the logs, but this is left as an exercise for the
interested reader.
- Can also be exploited without leaving any logs, per multiple sources
- If you know you don't need polkit functionality, consider a shell wrapper to trap and log (such as akhepcat's)
- Trustwave guide
Vulnerability scanning and testing
Other defense stacks and guides
back to top
Exploitation
Trivial - so expect many, this list will not be exhaustive
back to top
News and posts
back to top
Return to The Story So Far (list of notable security events)
Follow
@techsolvency
for security-only updates,
or
@TychoTithonus (me) for general/personal (and password cracking / hashcat stuff)