mac3d0/cve-2021-4034-pwnkitPoC educacional do CVE-2021-4034, o PwnKit, LPE via pkexec do polkit. Uso autorizado apenas.
Proof of concept for PwnKit, a local privilege escalation in polkit's pkexec. On a default install any unprivileged local user can become root.
Vulnerable versions of pkexec mishandle the process argument count. That lets controlled environment variables get reintroduced into pkexec's environment, which ends up running an attacker controlled shared object as root. It was disclosed on 25 January 2022 by the Qualys Research Team and scores 7.8 high on CVSS v3.1. The NVD entry is CVE-2021-4034.
Practically every polkit release since 2009 was affected until the coordinated fix. Distributions shipped patched packages on or after the disclosure date, so keep your vendor updates current.
This is an educational reference for a well documented, publicly disclosed vulnerability. I use it to study the pkexec argument handling flaw, to validate patch status in authorized labs and assessments, and to keep detection and remediation notes.
Only run this on systems you own or are authorized to test.
gcc cve-2021-4034-poc.c -o cve-2021-4034-poc
./cve-2021-4034-poc
On a vulnerable host it drops you into a root shell. Verified against Debian 10 buster and CentOS 7.
Patch polkit and pkexec to your distribution's fixed release. If you cannot patch right away, remove the SUID bit with chmod 0755 on the pkexec binary, accepting that you lose pkexec privilege delegation. For detection, alert on pkexec runs with an empty argv or with an odd environment such as GCONV_PATH, CHARSET or SHELL right before a root shell shows up.
The vulnerability was found and responsibly disclosed by the Qualys Research Team.
oss-security advisory: https://seclists.org/oss-sec/2022/q1/80
This code is published only for study and authorized security testing. Running it against systems you do not own or have written permission to test is illegal and can carry criminal and civil liability. Use it in your own labs or under a signed engagement scope. You are responsible for what you do with it.