A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
Connections 33
has cited scope1 retained · stored CVE-2021-4034 → n/a · polkit101ebb8b-bf1e-4298-95c5-996c6e18a689
has environmental constraint1 retained · stored CVE-2021-4034 → siemens · scalance_lpe9403761b4474-9f25-42da-b940-bb7fe3cf4222
has vulnerable target scope1 retained · stored CVE-2021-4034 → redhat · enterprise_linux_server_eusc0fea5e6-6418-4797-9613-2851168b3db0
has vulnerable target scope2 retained · stored CVE-2021-4034 → redhat · enterprise_linux_server_update_services_for_sap_solutionsc9fc6f57-b3af-4733-8c75-2e238ae2ec31f5bbe5bf-e3a8-4d16-bc00-27d6305d18fd
has vulnerable target scope3 retained · stored CVE-2021-4034 → redhat · enterprise_linux_for_power_little_endian_eus1d0a6ac5-ec4f-4592-b190-1cbbbc1772038f4436bf-b690-4b6b-bc31-1d4d5db60c83c65cb41f-83dc-4144-a1b9-ef4d58548c61
has vulnerable target scope1 retained · stored CVE-2021-4034 → starwindsoftware · starwind_virtual_san39a1b80b-4107-4b1f-87ae-07dbfaf1c30e
has vulnerable target scope2 retained · stored CVE-2021-4034 → redhat · enterprise_linux_for_ibm_z_systems_eus671323a3-5d5f-4a07-ba0a-39f04ae3f51176d411f1-6147-4ffd-af91-527fa04f984f
has vulnerable target scope1 retained · stored CVE-2021-4034 → suse · enterprise_storage73b3108d-a283-4f2a-923d-66b24383b3d9
has vulnerable target scope1 retained · stored CVE-2021-4034 → oracle · zfs_storage_appliance_kit1e97ca3e-535f-4ccd-a921-e046b5dc6c30
has vulnerable target scope1 retained · stored CVE-2021-4034 → suse · linux_enterprise_high_performance_computingf5715ab3-db98-4ad7-8939-2c5a4abb7e53
has vulnerable target scope1 retained · stored CVE-2021-4034 → siemens · scalance_lpe9403_firmware12a0bec7-177e-4f25-a4c4-08508fa7f4f5
has vulnerable target scope2 retained · stored CVE-2021-4034 → suse · linux_enterprise_serverc3f6e62f-3c99-4470-bda6-f8592f97258bcf12c3d0-1a1c-4d7a-85f7-9d152bf5d4e4
has vulnerable target scope1 retained · stored CVE-2021-4034 → siemens · sinumerik_edge5baf2148-0335-45b9-9cff-758784a0a878
has vulnerable target scope3 retained · stored CVE-2021-4034 → redhat · enterprise_linux_server_update_services_for_sap_solutions406a049f-6782-47a6-84df-5363d73e9da1c09bf5cb-9f61-4834-a5ef-7f88ad76d8c0f8bb70f0-3628-4260-9ebe-760147c95828
has vulnerable target scope1 retained · stored CVE-2021-4034 → suse · manager_server75e57c00-e77d-4876-8999-f2af573af2e1
has vulnerable target scope1 retained · stored CVE-2021-4034 → suse · linux_enterprise_workstation_extension8cc79b12-ec57-416e-80eb-489f93487f8b
has vulnerable target scope1 retained · stored CVE-2021-4034 → suse · manager_proxya9aefaae-817e-491e-8442-f1a6f200eeb8
has vulnerable target scope6 retained · stored CVE-2021-4034 → redhat · enterprise_linux_server_aus022e1001-b808-4745-a96d-d6ba352c0af547b9981c-e5f7-413a-a70a-5b0df06997455b28fe4d-51bb-4022-85f1-e7b1fbef6de55de1359f-1988-4bee-9794-e753e527f5dd890ecddd-3f93-4346-9a03-f44510bc30d4d2f62290-4de5-4c29-904d-0beef53f9327
has vulnerable target scope1 retained · stored CVE-2021-4034 → redhat · enterprise_linux_eus623cafcb-f1d6-47e9-b604-eb40c462c5c0
has vulnerable target scope1 retained · stored CVE-2021-4034 → starwindsoftware · command_center623b2e80-9f10-43f6-a410-d86cfcae7093
has vulnerable target scope2 retained · stored CVE-2021-4034 → redhat · enterprise_linux_server061d8955-1327-4550-9591-236aa90ca8b457114191-cdc5-4e25-aa7b-1ed4b40b9787
has vulnerable target scope1 retained · stored CVE-2021-4034 → suse · linux_enterprise_desktopcae01a34-8e88-48b4-abaf-bc0c67c886dd
has vulnerable target scope5 retained · stored CVE-2021-4034 → canonical · ubuntu_linux3bd6d0e4-c59f-470d-826d-76b31b11827a6afeb1f3-7763-4ea5-9e4e-d8aaac629c8a73919bb0-9945-49b5-85b8-8a29a110db2ae5baeeba-e83d-45be-b4ad-85d288614323e7c7c88f-697f-4752-9d54-1cbccd2f6790
has vulnerable target scope1 retained · stored CVE-2021-4034 → redhat · enterprise_linux_workstation1193cd35-d50a-40c1-9eec-6a5d1bb21b2c
has vulnerable target scope4 retained · stored CVE-2021-4034 → redhat · enterprise_linux_server_tus16c2fdda-54a1-4b78-81e6-a8456d7b7d5149524248-0382-4ba2-a396-1aa0286f89db5448751d-4d61-4e13-9b84-082d49eb7d4cc3c38995-224d-43d0-a031-d69adc307609
has vulnerable target scope2 retained · stored CVE-2021-4034 → oracle · http_server27d51b59-74d9-497d-9d98-db5c866bb9fd5c36cf27-189f-40df-8583-ba5de36f695b
has vulnerable target scope2 retained · stored CVE-2021-4034 → redhat · enterprise_linux_for_power_little_endian7730f3c4-51e6-47d5-b542-31fa0330224e94086eb8-633c-41af-9613-82f6fa0d755b
has vulnerable target scope1 retained · stored CVE-2021-4034 → redhat · enterprise_linux_for_scientific_computingc9f3807a-adcf-4f14-9353-33770f5e1fff
has vulnerable target scope1 retained · stored CVE-2021-4034 → polkit_project · polkitaac85c37-1ce8-4b68-a7ba-c4f7f3164d94
has vulnerable target scope1 retained · stored CVE-2021-4034 → redhat · enterprise_linux_desktope8b41497-d94c-40be-837f-eba9c5c60b7c
has vulnerable target scope1 retained · stored CVE-2021-4034 → redhat · enterprise_linuxe62f3c14-612b-4006-94f0-7abd123d2976
has vulnerable target scope2 retained · stored CVE-2021-4034 → redhat · enterprise_linux_for_ibm_z_systems5fc98050-3757-4576-9664-54a6f59ff053a0953659-2a70-45b4-b7a3-0220db53081c
has vulnerable target scope1 retained · stored CVE-2021-4034 → redhat · enterprise_linux_for_power_big_endian37635a60-165d-40de-9141-5974ac72dde5