Linux system service bug gives root on all major distros, exploit released

Reading Time: 1 Minute

CVE-2021-4034 has been named PwnKit and its origin has been tracked to the initial commit of pkexec, more than 12 years ago, meaning that all Polkit versions are affected.

Part of the Polkit open-source application framework that negotiates the interaction between privileged and unprivileged processes, pkexec allows an authorized user to execute commands as another user, doubling as an alternative to sudo.

Easy to exploit, PoC expected soon

Researchers at Qualys information security company found that the pkexec program could be used by local attackers to increase privileges to root on default installations of Ubuntu, Debian, Fedora, and CentOS.

They warn that PwnKit is likely exploitable on other Linux operating systems as well.

Bharat Jogi, Director of Vulnerability and Threat Research at Qualys explains that PwnKit is “a memory corruption vulnerability in Polkit’s, which allows any unprivileged user to gain full root privileges on a vulnerable system using default polkit configuration,”

 

The researcher notes that the issue has been hiding in plain sight since the first version of pkexec inn May 2009. The video below demonstrates the exploitability of the bug:

 

 

Exploiting the flaw is so easy, the researchers say, that proof-of-concept (PoC) exploit code is expected to become public in just a few days. The Qualys Research Team will not release a PoC for PwnKit.

Update: An exploit has already emerged in the public space, less than three hours after Qualys published the technical details for PwnKit. BleepingComputer has compiled and tested the available exploit, which proved to be reliable as it gave us root privileges on the system on all attempts.

 

 

chmod 0755 /usr/bin/pkexec

See Also: OSINT Tool: Commit Stream

“Users that want to look for signs of PwnKit exploitation can do it by checking the logs for either “The value for the SHELL variable was not found the /etc/shells file” or “The value for environment variable […] contains suspicious content.” entries.

However, Qualys notes that exploiting PwnKit is possible without leaving a trace.

Last year, GitHub Security Lab researcher Kevin Backhouse discovered another old privilege escalation vulnerability affecting Polkit.

The bug had been present for seven years, since version 0.113 of the component and affected popular Linux distros including RHEL 8, Fedora 21 (or later), Ubuntu 20.04, and unstable versions of Debian (‘bullseye’) and its derivatives.

Update [January 25, 17:26 EST]: Added security notices on PolicyKit / Polkit from Ubuntu and Red Hat.

Update [January 25, 17:43 EST]: Article updated with information about proof-of-concept exploit code being publicly available.

See Also: Stuxnet – A weapon made out of code that almost started WW3

Source: bleepingcomputer.com

(Click Link)