--- id: "CVE-2021-4034" kind: "vulnerability" aliases: ["CVE-2021-4034"] title: "A local privilege escalation vulnerability was found on polkit's pkexec utility" severity: "high" cvss: 7.8 epss: 0.94921 exploited: true status: "open" category: "infrastructure" products: [{"name": "Red Hat Polkit", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "polkit project polkit", "fixed": ["121"], "affected": "< 121", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server update services for sap solutions", "fixed": [], "affected": "= 7.6", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server update services for sap solutions", "fixed": [], "affected": "= 7.7", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux desktop", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for ibm z systems", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for ibm z systems", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for ibm z systems eus", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for ibm z systems eus", "fixed": [], "affected": "= 8.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for power big endian", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for power little endian", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for power little endian", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for power little endian eus", "fixed": [], "affected": "= 8.1", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for power little endian eus", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for power little endian eus", "fixed": [], "affected": "= 8.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux for scientific computing", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server", "fixed": [], "affected": "= 6.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server aus", "fixed": [], "affected": "= 7.3", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server aus", "fixed": [], "affected": "= 7.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server aus", "fixed": [], "affected": "= 7.6", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server aus", "fixed": [], "affected": "= 7.7", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server aus", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server aus", "fixed": [], "affected": "= 8.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server eus", "fixed": [], "affected": "= 8.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server tus", "fixed": [], "affected": "= 7.6", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server tus", "fixed": [], "affected": "= 7.7", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server tus", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server tus", "fixed": [], "affected": "= 8.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server update services for sap solutions", "fixed": [], "affected": "= 8.1", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server update services for sap solutions", "fixed": [], "affected": "= 8.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server update services for sap solutions", "fixed": [], "affected": "= 8.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux workstation", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 14.04", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 16.04", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 18.04", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 20.04", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 21.10", "ecosystem": "vendor"}, {"name": "suse enterprise storage", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "infrastructure", "linux", "pkexec", "polkit", "ransomware", "self-hosted", "shared-hosts"] not_affected_if: ["no-local-users", "polkit-not-installed"] published_at: "2022-01-28T20:15:12+00:00" first_seen_at: "2026-10-23T19:11:52+00:00" updated_at: "2026-10-23T22:29:04+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-4034", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-4034", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4034", "first_seen_at": "2026-10-23T22:29:04+00:00"}] --- # A local privilege escalation vulnerability was found on polkit's pkexec utility Polkit's pkexec utility has an out-of-bounds read and write bug that lets a local user gain root. An attacker with any local shell account gets administrative rights on the machine. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Red Hat Polkit affected ? fixed ? - vendor:polkit project polkit affected < 121 fixed 121 - vendor:redhat enterprise linux server update services for sap solutions affected = 7.6 fixed ? - vendor:redhat enterprise linux server update services for sap solutions affected = 7.7 fixed ? - vendor:redhat enterprise linux affected = 8.0 fixed ? - vendor:redhat enterprise linux desktop affected = 7.0 fixed ? - vendor:redhat enterprise linux eus affected = 8.2 fixed ? - vendor:redhat enterprise linux for ibm z systems affected = 7.0 fixed ? - vendor:redhat enterprise linux for ibm z systems affected = 8.0 fixed ? - vendor:redhat enterprise linux for ibm z systems eus affected = 8.2 fixed ? - vendor:redhat enterprise linux for ibm z systems eus affected = 8.4 fixed ? - vendor:redhat enterprise linux for power big endian affected = 7.0 fixed ? - vendor:redhat enterprise linux for power little endian affected = 7.0 fixed ? - vendor:redhat enterprise linux for power little endian affected = 8.0 fixed ? - vendor:redhat enterprise linux for power little endian eus affected = 8.1 fixed ? - vendor:redhat enterprise linux for power little endian eus affected = 8.2 fixed ? - vendor:redhat enterprise linux for power little endian eus affected = 8.4 fixed ? - vendor:redhat enterprise linux for scientific computing affected = 7.0 fixed ? - vendor:redhat enterprise linux server affected = 6.0 fixed ? - vendor:redhat enterprise linux server affected = 7.0 fixed ? - vendor:redhat enterprise linux server aus affected = 7.3 fixed ? - vendor:redhat enterprise linux server aus affected = 7.4 fixed ? - vendor:redhat enterprise linux server aus affected = 7.6 fixed ? - vendor:redhat enterprise linux server aus affected = 7.7 fixed ? - vendor:redhat enterprise linux server aus affected = 8.2 fixed ? - vendor:redhat enterprise linux server aus affected = 8.4 fixed ? - vendor:redhat enterprise linux server eus affected = 8.4 fixed ? - vendor:redhat enterprise linux server tus affected = 7.6 fixed ? - vendor:redhat enterprise linux server tus affected = 7.7 fixed ? - vendor:redhat enterprise linux server tus affected = 8.2 fixed ? - vendor:redhat enterprise linux server tus affected = 8.4 fixed ? - vendor:redhat enterprise linux server update services for sap solutions affected = 8.1 fixed ? - vendor:redhat enterprise linux server update services for sap solutions affected = 8.2 fixed ? - vendor:redhat enterprise linux server update services for sap solutions affected = 8.4 fixed ? - vendor:redhat enterprise linux workstation affected = 7.0 fixed ? - vendor:canonical ubuntu linux affected = 14.04 fixed ? - vendor:canonical ubuntu linux affected = 16.04 fixed ? - vendor:canonical ubuntu linux affected = 18.04 fixed ? - vendor:canonical ubuntu linux affected = 20.04 fixed ? - vendor:canonical ubuntu linux affected = 21.10 fixed ? - vendor:suse enterprise storage affected = 7.0 fixed ? ## Fix Apply the updates from the vendor (Red Hat, and the distribution's polkit package) per CISA's required action; the sources do not name the fixed package version. ## Timeline - 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-4034 - 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-4034 - 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-4034 ## From the sources A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_