--- id: CVE-2021-4034 title: >- A local privilege escalation vulnerability was found on polkit's pkexec utility summary: >- A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current … severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-787 - CWE-125 - CWE-787 vendor: polkit_project product: polkit affected: - polkit < 121 - enterprise_linux_server_update_services_for_sap_solutions = 7.6 - enterprise_linux_server_update_services_for_sap_solutions = 7.7 - enterprise_linux = 8.0 - enterprise_linux_desktop = 7.0 - enterprise_linux_eus = 8.2 - enterprise_linux_for_ibm_z_systems = 7.0 - enterprise_linux_for_ibm_z_systems = 8.0 - enterprise_linux_for_ibm_z_systems_eus = 8.2 - enterprise_linux_for_ibm_z_systems_eus = 8.4 - enterprise_linux_for_power_big_endian = 7.0 - enterprise_linux_for_power_little_endian = 7.0 - enterprise_linux_for_power_little_endian = 8.0 - enterprise_linux_for_power_little_endian_eus = 8.1 - enterprise_linux_for_power_little_endian_eus = 8.2 - enterprise_linux_for_power_little_endian_eus = 8.4 - enterprise_linux_for_scientific_computing = 7.0 - enterprise_linux_server = 6.0 - enterprise_linux_server = 7.0 - enterprise_linux_server_aus = 7.3 - enterprise_linux_server_aus = 7.4 - enterprise_linux_server_aus = 7.6 - enterprise_linux_server_aus = 7.7 - enterprise_linux_server_aus = 8.2 - enterprise_linux_server_aus = 8.4 - enterprise_linux_server_eus = 8.4 - enterprise_linux_server_tus = 7.6 - enterprise_linux_server_tus = 7.7 - enterprise_linux_server_tus = 8.2 - enterprise_linux_server_tus = 8.4 - enterprise_linux_server_update_services_for_sap_solutions = 8.1 - enterprise_linux_server_update_services_for_sap_solutions = 8.2 - enterprise_linux_server_update_services_for_sap_solutions = 8.4 - enterprise_linux_workstation = 7.0 - ubuntu_linux = 14.04 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ubuntu_linux = 20.04 - ubuntu_linux = 21.10 - enterprise_storage = 7.0 - linux_enterprise_high_performance_computing = 15.0 - manager_proxy = 4.1 - manager_server = 4.1 - linux_enterprise_desktop = 15 - linux_enterprise_server = 15 - linux_enterprise_workstation_extension = 12 - http_server = 12.2.1.3.0 - http_server = 12.2.1.4.0 - zfs_storage_appliance_kit = 8.8 - sinumerik_edge < 3.3.0 - scalance_lpe9403_firmware < 2.0 - command_center = 1.0 - starwind_virtual_san = v8 patched: - polkit 121 - sinumerik_edge 3.3.0 - scalance_lpe9403_firmware 2.0 published: '2022-01-28' updated: '2026-08-15' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-4034' references: - url: >- http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html label: secalert@redhat.com - url: >- http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html label: secalert@redhat.com - url: 'https://access.redhat.com/security/vulnerabilities/RHSB-2022-001' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2025869' label: secalert@redhat.com - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf' label: secalert@redhat.com - url: >- https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 label: secalert@redhat.com - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: secalert@redhat.com - url: 'https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt' label: secalert@redhat.com - url: >- https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/ label: secalert@redhat.com - url: 'https://www.starwindsoftware.com/security/sw-20220818-0001/' label: secalert@redhat.com - url: 'https://www.suse.com/support/kb/doc/?id=000020564' label: secalert@redhat.com - url: >- http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/security/vulnerabilities/RHSB-2022-001' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2025869' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.starwindsoftware.com/security/sw-20220818-0001/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.suse.com/support/kb/doc/?id=000020564' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.vicarius.io/vsociety/posts/pwnkit-pkexec-lpe-cve-2021-4034' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-4034 label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 tags: - nvd - kev - in-the-wild - exploit-available epss: 0.94921 epssPercentile: 0.99859 kev: true kevDateAdded: '2022-06-27' kevDueDate: '2022-07-18' kevRansomware: true exploited: true exploitAvailable: true ingestedAt: '2026-08-15T04:24:40.750Z' exploits: exploitdb: true github: 183 githubRepos: - 'https://github.com/ryaagard/CVE-2021-4034' - 'https://github.com/berdav/CVE-2021-4034' - 'https://github.com/clubby789/CVE-2021-4034' metasploit: - exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec checkedAt: '2026-09-21T15:24:43.855Z' --- ## Overview A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. ## Affected - `polkit < 121` - `enterprise_linux_server_update_services_for_sap_solutions = 7.6` - `enterprise_linux_server_update_services_for_sap_solutions = 7.7` - `enterprise_linux = 8.0` - `enterprise_linux_desktop = 7.0` - `enterprise_linux_eus = 8.2` - `enterprise_linux_for_ibm_z_systems = 7.0` - `enterprise_linux_for_ibm_z_systems = 8.0` - `enterprise_linux_for_ibm_z_systems_eus = 8.2` - `enterprise_linux_for_ibm_z_systems_eus = 8.4` - `enterprise_linux_for_power_big_endian = 7.0` - `enterprise_linux_for_power_little_endian = 7.0` - `enterprise_linux_for_power_little_endian = 8.0` - `enterprise_linux_for_power_little_endian_eus = 8.1` - `enterprise_linux_for_power_little_endian_eus = 8.2` - `enterprise_linux_for_power_little_endian_eus = 8.4` - `enterprise_linux_for_scientific_computing = 7.0` - `enterprise_linux_server = 6.0` - `enterprise_linux_server = 7.0` - `enterprise_linux_server_aus = 7.3` - `enterprise_linux_server_aus = 7.4` - `enterprise_linux_server_aus = 7.6` - `enterprise_linux_server_aus = 7.7` - `enterprise_linux_server_aus = 8.2` - `enterprise_linux_server_aus = 8.4` - `enterprise_linux_server_eus = 8.4` - `enterprise_linux_server_tus = 7.6` - `enterprise_linux_server_tus = 7.7` - `enterprise_linux_server_tus = 8.2` - `enterprise_linux_server_tus = 8.4` - `enterprise_linux_server_update_services_for_sap_solutions = 8.1` - `enterprise_linux_server_update_services_for_sap_solutions = 8.2` - `enterprise_linux_server_update_services_for_sap_solutions = 8.4` - `enterprise_linux_workstation = 7.0` - `ubuntu_linux = 14.04` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ubuntu_linux = 20.04` - `ubuntu_linux = 21.10` - `enterprise_storage = 7.0` - `linux_enterprise_high_performance_computing = 15.0` - `manager_proxy = 4.1` - `manager_server = 4.1` - `linux_enterprise_desktop = 15` - `linux_enterprise_server = 15` - `linux_enterprise_workstation_extension = 12` - `http_server = 12.2.1.3.0` - `http_server = 12.2.1.4.0` - `zfs_storage_appliance_kit = 8.8` - `sinumerik_edge < 3.3.0` - `scalance_lpe9403_firmware < 2.0` - `command_center = 1.0` - `starwind_virtual_san = v8` ## Remediation Upgrade past the affected range: - `polkit 121` - `sinumerik_edge 3.3.0` - `scalance_lpe9403_firmware 2.0`