{"id":"CVE-2021-4034","kind":"vulnerability","aliases":["CVE-2021-4034"],"related":[],"title":"A local privilege escalation vulnerability was found on polkit's pkexec utility","description":"A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.","summary":"Polkit's pkexec utility has an out-of-bounds read and write bug that lets a local user gain root. An attacker with any local shell account gets administrative rights on the machine.","severity":"high","cvss":7.8,"epss":0.94921,"exploited":true,"exploited_at":"2022-06-27T00:00:00+00:00","products":[{"name":"Red Hat Polkit","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"polkit project polkit","fixed":["121"],"affected":"< 121","ecosystem":"vendor"},{"name":"redhat enterprise linux server update services for sap solutions","fixed":[],"affected":"= 7.6","ecosystem":"vendor"},{"name":"redhat enterprise linux server update services for sap solutions","fixed":[],"affected":"= 7.7","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat enterprise linux desktop","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"redhat enterprise linux for ibm z systems","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux for ibm z systems","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat enterprise linux for ibm z systems eus","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"redhat enterprise linux for ibm z systems eus","fixed":[],"affected":"= 8.4","ecosystem":"vendor"},{"name":"redhat enterprise linux for power big endian","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux for power little endian","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux for power little endian","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat enterprise linux for power little endian eus","fixed":[],"affected":"= 8.1","ecosystem":"vendor"},{"name":"redhat enterprise linux for power little endian eus","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"redhat enterprise linux for power little endian eus","fixed":[],"affected":"= 8.4","ecosystem":"vendor"},{"name":"redhat enterprise linux for scientific computing","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux server","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux server","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux server aus","fixed":[],"affected":"= 7.3","ecosystem":"vendor"},{"name":"redhat enterprise linux server aus","fixed":[],"affected":"= 7.4","ecosystem":"vendor"},{"name":"redhat enterprise linux server aus","fixed":[],"affected":"= 7.6","ecosystem":"vendor"},{"name":"redhat enterprise linux server aus","fixed":[],"affected":"= 7.7","ecosystem":"vendor"},{"name":"redhat enterprise linux server aus","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"redhat enterprise linux server aus","fixed":[],"affected":"= 8.4","ecosystem":"vendor"},{"name":"redhat enterprise linux server eus","fixed":[],"affected":"= 8.4","ecosystem":"vendor"},{"name":"redhat enterprise linux server tus","fixed":[],"affected":"= 7.6","ecosystem":"vendor"},{"name":"redhat enterprise linux server tus","fixed":[],"affected":"= 7.7","ecosystem":"vendor"},{"name":"redhat enterprise linux server tus","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"redhat enterprise linux server tus","fixed":[],"affected":"= 8.4","ecosystem":"vendor"},{"name":"redhat enterprise linux server update services for sap solutions","fixed":[],"affected":"= 8.1","ecosystem":"vendor"},{"name":"redhat enterprise linux server update services for sap solutions","fixed":[],"affected":"= 8.2","ecosystem":"vendor"},{"name":"redhat enterprise linux server update services for sap solutions","fixed":[],"affected":"= 8.4","ecosystem":"vendor"},{"name":"redhat enterprise linux workstation","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 14.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 16.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 18.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 20.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 21.10","ecosystem":"vendor"},{"name":"suse enterprise storage","fixed":[],"affected":"= 7.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","linux","pkexec","polkit","ransomware","self-hosted","shared-hosts"],"not_affected_if":["no-local-users","polkit-not-installed"],"how_to_check":null,"fix":"Apply the updates from the vendor (Red Hat, and the distribution's polkit package) per CISA's required action; the sources do not name the fixed package version.","status":"open","published_at":"2022-01-28T20:15:12+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:29+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:12:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates from the vendor (Red Hat, and the distribution's polkit package) per CISA's required action; the sources do not name the fixed package version.","reach":"local","impact":"high","summary":"Polkit's pkexec utility has an out-of-bounds read and write bug that lets a local user gain root. An attacker with any local shell account gets administrative rights on the machine.","category":"infrastructure","who_cares":["linux","polkit","pkexec","self-hosted","shared-hosts"],"confidence":0.8,"needs_auth":"yes","worst_case":"local user gains root and full control of the machine","analyst_note":"Find the fixed polkit package versions per distro and a check command from the Red Hat or distro advisory for CVE-2021-4034; the sources list only KEV and EPSS.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-local-users","polkit-not-installed"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000462,"input_tokens":2842,"output_tokens":356,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':14A,17A '-4034':15A,18A 'accord':323C 'account':286B 'administr':288B,383C 'allow':314C 'applic':307C 'arbitrari':367C 'attack':281B,349C,373C 'aus':147A,152A,157A,162A,167A,172A 'big':89A 'bound':268B 'bug':272B 'call':335C 'canonical':229A,232A,235A,238A,241A 'caus':375C 'code':368C 'command':319C,347C 'computing':134A 'correct':338C 'count':337C 'craft':354C 'current':327C 'cve':13A,16A 'design':312C 'desktop':49A 'doesn':331C 'end':340C 'endian':90A,97A,104A,111A,119A,127A 'enterprise':26A,35A,44A,47A,51A,55A,62A,69A,77A,85A,92A,99A,106A,114A,122A,130A,136A,140A,144A,149A,154A,159A,164A,169A,174A,179A,184A,189A,194A,199A,208A,217A,226A,245A 'environ':344C,355C 'escal':4A,296C,379C 'eus':53A,75A,83A,112A,120A,128A,177A 'execut':343C,366C,371C 'exploit':247B 'for':31A,40A,57A,64A,71A,79A,87A,94A,101A,108A,116A,124A,132A,204A,213A,222A 'found':7A,299C 'gain':278B 'get':287B 'given':380C 'handl':333C 'hat':20A 'host':255B,258B 'ibm':58A,65A,72A,80A 'induc':363C 'infrastructur':248B 'let':274B 'leverag':351C 'linux':27A,36A,45A,48A,52A,56A,63A,70A,78A,86A,93A,100A,107A,115A,123A,131A,137A,141A,145A,150A,155A,160A,165A,170A,175A,180A,185A,190A,195A,200A,209A,218A,227A,231A,234A,237A,240A,243A,249B 'little':96A,103A,110A,118A,126A 'll':362C 'local':2A,276B,284B,294C,377C 'machin':292B,388C 'out-of-bound':265B 'paramet':336C 'pkexec':11A,250B,261B,303C,306C,330C,364C 'polici':325C 'polkit':9A,21A,22A,24A,251B,259B,301C 'power':88A,95A,102A,109A,117A,125A 'predefin':324C 'privileg':3A,295C,321C,378C 'project':23A 'ransomwar':252B 'read':269B 'red':19A 'redhat':25A,34A,43A,46A,50A,54A,61A,68A,76A,84A,91A,98A,105A,113A,121A,129A,135A,139A,143A,148A,153A,158A,163A,168A,173A,178A,183A,188A,193A,198A,207A,216A,225A 'right':289B,384C 'root':279B 'run':318C 'sap':32A,41A,205A,214A,223A 'scientific':133A 'self':254B 'self-host':253B 'server':28A,37A,138A,142A,146A,151A,156A,161A,166A,171A,176A,181A,186A,191A,196A,201A,210A,219A 'services':30A,39A,203A,212A,221A 'setuid':310C 'share':257B 'shared-host':256B 'shell':285B 'solutions':33A,42A,206A,215A,224A 'storage':246A 'success':370C 'suse':244A 'systems':60A,67A,74A,82A 'target':387C 'tool':311C 'tri':341C 'tus':182A,187A,192A,197A 'ubuntu':230A,233A,236A,239A,242A 'unprivileg':315C,381C 'update':29A,38A,202A,211A,220A 'user':277B,316C,322C,382C 'util':12A,262B,304C 'variabl':345C,356C 'version':328C 'vulner':5A,297C 'way':360C 'workstation':228A 'write':271B 'z':59A,66A,73A,81A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-01-28T20:15:12+00:00","kev":{"dateAdded":"2022-06-27","dueDate":"2022-07-18","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-4034","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-4034","severity":null,"published_at":"2022-06-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T20:35:35+00:00","note":null},{"source":"epss","external_id":"CVE-2021-4034","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-4034","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-4034","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4034","severity":null,"published_at":"2022-01-28T20:15:12+00:00","modified_at":"2026-08-15T04:17:57+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}