Linux system service bug gives you root on every major distro

A vulnerability in Polkit's pkexec component that is present in the default configuration of all major Linux distributions can be exploited to gain full root privileges on the system, researchers warn today.

Identified as CVE-2021-4034 and named PwnKit, the security issue has been tracked to the initial commit of pkexec, more than 12 years ago, meaning that all Polkit versions are affected.

Part of the Polkit open-source application framework that negotiates the interaction between privileged and unprivileged processes, pkexec allows an authorized user to execute commands as another user, doubling as an alternative to sudo.

Easy to exploit, PoC expected soon

Researchers at Qualys information security company found that the pkexec program could be used by local attackers to increase privileges to root on default installations of Ubuntu, Debian, Fedora, and CentOS.

They warn that PwnKit is likely exploitable on other Linux operating systems as well.

Bharat Jogi, Director of Vulnerability and Threat Research at Qualys explains that PwnKit is “a memory corruption vulnerability in Polkit’s, which allows any unprivileged user to gain full root privileges on a vulnerable system using default polkit configuration,”

The researcher notes that the issue has been hiding in plain sight since the first version of pkexec inn May 2009. The video below demonstrates the exploitability of the bug:

Exploiting the flaw is so easy, the researchers say, that proof-of-concept (PoC) exploit code is expected to become public in just a few days. The Qualys Research Team will not release a PoC for PwnKit.

Qualys reported the security issue responsibly on November 18, 2021, and waited for a patch to become available before publishing the technical details behind PwnKit.

The company strongly recommends administrators prioritize applying the patches that Polkit’s authors released on their GitLab a couple of hours ago.

Linux distros had access to the patch a couple of weeks before today’s coordinated disclosure from Qualys and are expected to release updated pkexec packages starting today.

A temporary mitigation for operating systems that have yet to push a patch is to strip pkexec of the the read/write rights with the following command:

chmod 0755 /usr/bin/pkexec

"Users that want to look for signs of PwnKit exploitation can do it by checking the logs for either “The value for the SHELL variable was not found the /etc/shells file” or “The value for environment variable […] contains suspicious content.” entries.

However, Qualys notes that exploiting PwnKit is possible without leaving a trace.

Last year, GitHub Security Lab researcher Kevin Backhouse discovered another old privilege escalation vulnerability affecting Polkit.

The bug had been present for seven years, since version 0.113 of the component and affected popular Linux distros including RHEL 8, Fedora 21 (or later), Ubuntu 20.04, and unstable versions of Debian ('bullseye') and its derivatives.

 Linux system service bug gives you root on every major distro