Proof of Concept (PoC): CVE-2021-4034 (PwnKit)

Note: This repository and its content are part of a Final Degree Project (FDP), created solely for educational purposes and academic research.

Description

This repository contains a proof of concept (PoC) for the CVE-2021-4034 vulnerability, also known as PwnKit. This memory corruption vulnerability affects the pkexec component of Polkit on Linux systems. When pkexec is executed with an empty argument list (argc == 0), environment variables can be manipulated to force the loading of an arbitrary shared library, thereby achieving local privilege escalation.

Exploitation phases (Environment analysis)

The steps required to prepare the execution environment to exploit the flaw are described below. This process details how pkexec's memory read/write error is leveraged:

1. Environment preparation (gconv structure)

This exploit abuses the way GLib handles character conversion when trying to print an error message. To do so, the first step is to create a specific directory structure that will serve as a local repository of GCONV conversion modules for GLib.

2. Environment variable manipulation

The key to the vulnerability is injecting the GCONV_PATH environment variable, exploiting the out-of-bounds write caused by pkexec's argc == 0 condition. In this way, the program is forced to use an anomalous character set, which tells GLib to look for character conversion modules in the controlled directory created in the previous step.

3. Creating a malicious shared library (.so)

To execute our code, a shared library (shared object or .so) must be compiled. When pkexec tries to process a character set it cannot find, it will load this library from our fake gconv directory. Since pkexec is a binary with the SUID bit set (it runs as root), loading this library will give our code root privileges, taking full control of the system (for example, by opening a root shell).

4. Configuration of the gconv-modules file

Finally, a configuration file named gconv-modules must be created in that local directory. This file acts as an index: it tells GLib which specific library (.so) to load to perform the conversion of the requested specific character set. This file links the conversion requested by pkexec with the shared library created in step 3.

Compilation and Cleanup

The project includes a Makefile to automate the compilation of the C binary and the cleanup of the environment.

• To compile the project: $ make

• To clean up the generated files (temporary files, folders, and binaries): $ make clean