12-year-old Linux root privilege flaw has been "hiding in plain sight"
Researchers were quick to highlight how easy it was to exploit the vulnerability, recommending urgent patches
An 'easily exploitable' root privilege security vulnerability has been discovered in popular default Linux distributions and "has been hiding in plain sight" for more than 12 years, according to security researchers.
Qualys discovered and developed a working exploit for the vulnerability, dubbed 'PwnKit', which could allow an unprivileged user to gain root privileges on a vulnerable machine. The researchers said it affects popular distros including Ubuntu, Debian, Fedora, and CentOS, adding that other distros are also likely vulnerable and exploitable.
The flaw was found in Polkit - a component in Unix-like systems that allows non-privileged processes to communicate with privileged processes using the command 'pkexec' followed by the command set to be executed.
Qualys said the vulnerability affects all versions of pkexec since its first version in May 2009 (commit c8c3d83) and is tracked as CVE-2021-4034. Achieving root access allows an attacker to execute any command on, and access any part of a system.
The vulnerability is not remotely exploitable, which means the attacker would need to have physical access to the target machine, but Qualys said the exploit can be executed quickly to gain root privileges.
The author of the blog post that detailed the vulnerability, Bharat Jogi, director of vulnerability and threat research at Qualys, said he would not be publishing exploit code but given the simple nature of exploiting it, Qualys expects publicly available exploits to be circulating within days.
Businesses concerned about the vulnerability in their environments can check for patches for their specific distro but if there are none available, one workaround is to remove the SUID-bit from pkexec as a temporary mitigation.
Technical details of PwnKit
The full technical details can be found in Qualys' blog post but in summary, the vulnerability lies in the way pkexec reads environmental variables and attackers can re-introduce unsecured environmental variables that are normally removed from the environment of SUID programs before the main function is called.
The top three IT pains of the new reality and how to solve them
Driving more resiliency with unified operations and service managementFree download
Qualys' concise description: "If our PATH is “PATH=name=.”, and if the directory “name=.” exists and contains an executable file named “value”, then a pointer to the string “name=./value” is written out-of-bounds to envp."
Although polkit supports other non-Linux operating systems such as Solaris and *BSD, Qualys has not yet investigated if the exploit works on these systems but can confirm OpenBSD is not exploitable.
"Given the breadth of the attack surface for this vulnerability across both Linux and non-Linux OS, Qualys recommends that users apply patches for this vulnerability immediately," said Jogi.
Activation playbook: Deliver data that powers impactful, game-changing campaigns
Bringing together data and technology to drive better business outcomesFree Download
In unpredictable times, a data strategy is key
Data processes are crucial to guide decisions and drive business growthFree Download
Achieving resiliency with Everything-as-a-Service (XAAS)
Transforming the enterprise IT landscapeFree Download
What is contextual analytics?
Creating more customer value in HR software applicationsFree Download