PwnKit CVE-2021-4034 (polkit pkexec local privilege escalation to root on almost every Linux distribution, CISA KEV): how do I check old servers and images, and what's the temporary mitigation if I can't update polkit?

What it is: CVE-2021-4034, nicknamed PwnKit, is a flaw in pkexec, the setuid-root program that ships with polkit. pkexec mishandled its argument count, so any unprivileged local user could get full root privileges, even if the polkit daemon isn't running. Qualys disclosed it in January 2022; pkexec had been vulnerable since its creation in May 2009, and it is installed by default on all major Linux distributions (Qualys exploited Ubuntu, Debian, Fedora and CentOS). It is in CISA's Known Exploited Vulnerabilities catalog (added 2022-06-27). It matters wherever untrusted code or users get a shell: shared servers, CI runners, containers built from old base images, and any box where an attacker already has a foothold. Am I affected: - Linux systems with polkit's pkexec whose polkit package hasn't been updated since the January 2022 fixes from your distribution. - Check the installed package version against your distribution's advisory for CVE-2021-4034 (for example rpm -q polkit or dpkg -l policykit-1 / polkit, depending on the distribution), and whether /usr/bin/pkexec exists and is setuid (ls -l /usr/bin/pkexec shows an 's' in the owner permissions). Fix: 1. Update the polkit package from your distribution and rebuild container images from updated base images. Red Hat strongly recommends updating as the fix. 2. If you can't update yet, Qualys's temporary mitigation is to remove the setuid bit from pkexec: chmod 0755 /usr/bin/pkexec. Red Hat also documents a SystemTap-based mitigation for its systems. Removing the setuid bit stops pkexec from working for legitimate use until you update and restore the package's permissions. 3. Since this only needs local access, review who and what can run code on each machine (shared accounts, CI jobs, web apps that could be compromised). Verify: the polkit package matches a fixed version from your distribution's advisory (or pkexec is no longer setuid as a temporary measure), and your vulnerability scanner no longer flags CVE-2021-4034. Sources: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt https://access.redhat.com/security/vulnerabilities/RHSB-2022-001 https://nvd.nist.gov/vuln/detail/CVE-2021-4034 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-4034