IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

12-year-old Linux root privilege flaw has been "hiding in plain sight"

Researchers were quick to highlight how easy it was to exploit the vulnerability, recommending urgent patches

An 'easily exploitable' root privilege security vulnerability has been discovered in popular default Linux distributions and "has been hiding in plain sight" for more than 12 years, according to security researchers.

Qualys discovered and developed a working exploit for the vulnerability, dubbed 'PwnKit', which could allow an unprivileged user to gain root privileges on a vulnerable machine. The researchers said it affects popular distros including Ubuntu, Debian, Fedora, and CentOS, adding that other distros are also likely vulnerable and exploitable.

The flaw was found in Polkit - a component in Unix-like systems that allows non-privileged processes to communicate with privileged processes using the command 'pkexec' followed by the command set to be executed.

Qualys said the vulnerability affects all versions of pkexec since its first version in May 2009 (commit c8c3d83) and is tracked as CVE-2021-4034. Achieving root access allows an attacker to execute any command on, and access any part of a system.

The vulnerability is not remotely exploitable, which means the attacker would need to have physical access to the target machine, but Qualys said the exploit can be executed quickly to gain root privileges.

The author of the blog post that detailed the vulnerability, Bharat Jogi, director of vulnerability and threat research at Qualys, said he would not be publishing exploit code but given the simple nature of exploiting it, Qualys expects publicly available exploits to be circulating within days. 

Businesses concerned about the vulnerability in their environments can check for patches for their specific distro but if there are none available, one workaround is to remove the SUID-bit from pkexec as a temporary mitigation.

Technical details of PwnKit

The full technical details can be found in Qualys' blog post but in summary, the vulnerability lies in the way pkexec reads environmental variables and attackers can re-introduce unsecured environmental variables that are normally removed from the environment of SUID programs before the main function is called.

Related Resource

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Man at his computer next to title card - whitepaper from ServiceNowFree download

Qualys' concise description: "If our PATH is “PATH=name=.”, and if the directory “name=.” exists and contains an executable file named “value”, then a pointer to the  string “name=./value” is written out-of-bounds to envp[0]."

Although polkit supports other non-Linux operating systems such as Solaris and *BSD, Qualys has not yet investigated if the exploit works on these systems but can confirm OpenBSD is not exploitable.

"Given the breadth of the attack surface for this vulnerability across both Linux and non-Linux OS, Qualys recommends that users apply patches for this vulnerability immediately," said Jogi. 

Featured Resources

What 2023 will mean for the industry

What do most IT decision makers really think will be the important trends and challenges in the coming year?

Free Download

2022 Magic quadrant for Security Information and Event Management (SIEM)

SIEM is evolving into a security platform with multiple features and deployment models

Free Download

IDC MarketScape: Worldwide unified endpoint management services

2022 vendor assessment

Free Download

Magic quadrant for application performance monitoring and observability

Enabling continuous updating of diverse & dynamic application environments

View Now

Most Popular

Dutch hacker steals data from virtually entire population of Austria
data breaches

Dutch hacker steals data from virtually entire population of Austria

26 Jan 2023
GTA V vulnerability exposes PC users to partial remote code execution attacks
vulnerability

GTA V vulnerability exposes PC users to partial remote code execution attacks

23 Jan 2023
European partners expect growth this year, here are three ways they will achieve it
Sponsored

European partners expect growth this year, here are three ways they will achieve it

17 Jan 2023