← לוח פגיעויות

CVE-2021-4034

גבוהה 7.8 מנוצלת בשטח (KEV)

ניצול פעיל מאומת — קטלוג CISA KEV

שם
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
נוסף לקטלוג
יעד טיפול (פדרלי)
פעולה נדרשת
Apply updates per vendor instructions.

תיאור (מקור, אנגלית)

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

מדדים

CVSS 3.1
7.8 (HIGH) מקור הציון: NVD CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS — סבירות ניצול
95% (אחוזון 100) נכון ל-25/7/2026
CWE
CWE-787, CWE-125

מוצרים מושפעים

polkit_project: polkit; redhat: enterprise linux server update services for sap solutions; redhat: enterprise linux; redhat: enterprise linux desktop; redhat: enterprise linux eus; redhat: enterprise linux for ibm z systems; redhat: enterprise linux for ibm z systems eus; redhat: enterprise linux for power big endian; redhat: enterprise linux for power little endian; redhat: enterprise linux for power little endian eus; redhat: enterprise linux for scientific computing; redhat: enterprise linux server; redhat: enterprise linux server aus; redhat: enterprise linux server eus; redhat: enterprise linux server tus

קישורים