CVE-2021-4034 (PwnKit) Mock Vulnerability System

This project is a mock system that reproduces the core operating principles of CVE-2021-4034 (Out-of-Bounds Read/Write) vulnerability in the Linux pkexec daemon. Without actual SUID privilege escalation, it safely simulates the mechanism of environment variable memory region overrun and malicious payload injection within a controlled environment.

In particular, this mock system detects the defense mechanism of modern Linux kernels (which forces insertion of an empty string when an empty array is passed, effectively making argc=1) and adjusts offsets accordingly, successfully emulating the vulnerable memory environment of the past.

📂 Project Structure

cve-2021-4034-mock/
├── README.md                # Project description and execution guide
├── src/
│   ├── mock_pkexec.c        # Target daemon source with missing argument (argc) validation
│   └── exploit.c            # Attacker source that delivers exploit payload via execve
└── bin/                     # Compiled binary storage path (created at build time)

🚀 Build Instructions

Navigate to the project root directory in the terminal and compile the source code by entering the following commands one line at a time in order.

# 1. Create the bin folder for storing executables
mkdir -p bin

# 2. Compile the target program (mock system)
gcc -Wall -Wextra -o bin/mock_pkexec src/mock_pkexec.c

# 3. Compile the exploit script
gcc -Wall -Wextra -o bin/exploit src/exploit.c

If compilation succeeds, the mock_pkexec and exploit executables will be created inside the bin/ folder.

💻 Execution and Demonstration

1. Normal Execution

When executed with properly passed arguments, it demonstrates that the program either fails the privilege check due to defense logic or exits safely.

./bin/mock_pkexec test_argument

• Result: The memory map is printed normally, and the program exits with an [OK] message.

2. Exploit Demonstration (Triggering Vulnerabilities)

Run the exploit script to forcefully pass an argc=0 payload (NULL array) and trigger the vulnerability.

./bin/exploit

• Detailed Result Analysis:

1. Kernel Defense Mechanism Detection: The mock system detects that modern OS kernels forcibly set argc to 1 and dynamically corrects the memory reference index.
2. Out-of-Bounds (OOB) Occurrence: Due to missing index validation, the system overflows the argv array boundary and encroaches on the adjacent envp region.
3. Environment Variable Injection: Restricted security environment variables (GCONV_PATH) are successfully overwritten in system memory, and a red [FATAL] ENVIRONMENT CORRUPTION DETECTED! warning is displayed.

🧹 Clean up

After testing, use the following command to delete the compiled binary files.

rm -rf bin/