{ "file_item": { "filepath": "security-advisories", "filename": "CERT-EU-SA2022-007.pdf" }, "title": "Serious Vulnerability in All Major Linux Distributions", "serial_number": "2022-007", "publish_date": "27-01-2022 17:27:00", "description": "On January 25, Polkit's authors released a patch for their software fixing a severe vulnerability that could lead to local privilege escalation on all Major Linux distributions (including Ubuntu, Debian, Fedora, and CentOS).
Exploits for this vulnerability already exist in the wild.
It is recommended to update Linux distributions as soon as possible.", "url_title": "2022-007", "content_markdown": "---\ntitle: 'Serious Vulnerability in\u00a0All\u00a0Major\u00a0Linux\u00a0Distributions'\nversion: '1.0'\nnumber: '2022-007'\ndate: 'January 27, 2022'\n---\n\n_History:_\n\n* _27/01/2022 --- v1.0 -- Initial publication_\n\n# Summary\n\nOn January 25, Polkit's authors released a patch for their software fixing a severe vulnerability that could lead to local privilege escalation on all Major Linux distributions (including Ubuntu, Debian, Fedora, and CentOS) [1,2].\n\n**Exploits for this vulnerability already exist in the wild**.\n\nIt is recommended to update Linux distributions as soon as possible.\n\n# Technical Details\n\nThe vulnerability, identified as `CVE-2021-4034`, has a severity score of 7.8 out of 10. This is a memory corruption vulnerability caused by the way arguments are read by the `pkexec` component of Polkit. This would allow to reintroduce an _unsecure_ (because it leads to the execution of arbitrary libraries) environment variable into `pkexec`'s environment that would normally be removed before the program execution [2].\n\nThis vulnerability is really easy to exploit.\n\n# Affected Products\n\nAll versions of Polkit since the first introduction of `pkexec` are vulnerable (since version 0.113 from 2009). The authors have integrated a fix in the last published release, but has not created a specific release number [3].\n\n# Recommendations\n\nCERT-EU recommends updating all running Linux distributions that provided a backport of the fix [4, 5, 6, 7]:\n\n- Ubuntu 14.04, 16.04 ESM\n- Ubuntu 18.04, 20.04, and 21.04\n- RedHat at Workstation and Enterprise products for supported architectures, as well as for extended life cycle support, TUS, and AUS.\n- Debian Stretch, Buster, Bellseye, unstable\n\nA reboot might be necessary.\n\n## Workaround\n\nA temporary mitigation is available to prevent from the privilege escalation vulnerability:\n\n```\nchmod 0755 /usr/bin/pkexec\n```\n\n## Analysis\n\nCERT-EU also recommends searching for exploitation attempts by checking the logs against the following strings:\n\n```\n\"The value for the SHELL variable was not found the /etc/shells file\"\nand/or\n\"The value for environment variable [\u2026] contains suspicious content.\"\n```\n\nHowever, Qualys notes that exploiting PwnKit is possible without leaving a trace [2].\n\n# References\n\n[1] \n\n[2] \n\n[3] \n\n[4] \n\n[5] \n\n[6] \n\n[7] \n", "content_html": "

History:

  • 27/01/2022 --- v1.0 -- Initial publication

Summary

On January 25, Polkit's authors released a patch for their software fixing a severe vulnerability that could lead to local privilege escalation on all Major Linux distributions (including Ubuntu, Debian, Fedora, and CentOS) [1,2].

Exploits for this vulnerability already exist in the wild.

It is recommended to update Linux distributions as soon as possible.

Technical Details

The vulnerability, identified as CVE-2021-4034, has a severity score of 7.8 out of 10. This is a memory corruption vulnerability caused by the way arguments are read by the pkexec component of Polkit. This would allow to reintroduce an unsecure (because it leads to the execution of arbitrary libraries) environment variable into pkexec's environment that would normally be removed before the program execution [2].

This vulnerability is really easy to exploit.

Affected Products

All versions of Polkit since the first introduction of pkexec are vulnerable (since version 0.113 from 2009). The authors have integrated a fix in the last published release, but has not created a specific release number [3].

Recommendations

CERT-EU recommends updating all running Linux distributions that provided a backport of the fix [4, 5, 6, 7]:

  • Ubuntu 14.04, 16.04 ESM
  • Ubuntu 18.04, 20.04, and 21.04
  • RedHat at Workstation and Enterprise products for supported architectures, as well as for extended life cycle support, TUS, and AUS.
  • Debian Stretch, Buster, Bellseye, unstable

A reboot might be necessary.

Workaround

A temporary mitigation is available to prevent from the privilege escalation vulnerability:

chmod 0755 /usr/bin/pkexec\n

Analysis

CERT-EU also recommends searching for exploitation attempts by checking the logs against the following strings:

\"The value for the SHELL variable was not found the /etc/shells file\"\nand/or\n\"The value for environment variable [\u2026] contains suspicious content.\"\n

However, Qualys notes that exploiting PwnKit is possible without leaving a trace [2].

References

[1] https://www.bleepingcomputer.com/news/security/linux-system-service-bug-gives-root-on-all-major-distros-exploit-released/

[2] https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

[3] https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/104/diffs

[4] https://ubuntu.com/security/notices/USN-5252-2

[5] https://ubuntu.com/security/notices/USN-5252-1

[6] https://access.redhat.com/security/security-updates/#/?q=polkit&p=1&sort=portal_publication_date%20desc&rows=10&portal_advisory_type=Security%20Advisory&documentKind=PortalProduct

[7] https://security-tracker.debian.org/tracker/CVE-2021-4034

", "licence": { "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)", "link": "https://creativecommons.org/licenses/by/4.0/", "restrictions": "https://cert.europa.eu/legal-notice", "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies" } }