A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

🗓️ 30 Jan 2022 16:00:00Reported by MicrosoftType

mscve

mscve🔗 msrc.microsoft.com👁 7 Views

Local privilege escalation in polkit pkexec via environment variables causing code execution.

Reporter	Title	Published	Views	Family All 440
GithubExploit	Exploit for Out-of-bounds Write in Polkit_Project Polkit	28 Jan 202214:04	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Polkit_Project Polkit	26 Jan 202205:44	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Polkit_Project Polkit	4 Feb 202419:00	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Polkit_Project Polkit	3 Mar 202218:29	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Polkit_Project Polkit	10 Oct 202222:56	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Polkit_Project Polkit	28 Jan 202203:19	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Polkit_Project Polkit	26 Jan 202216:43	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Polkit_Project Polkit	26 Jan 202203:33	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Polkit_Project Polkit	23 Mar 202211:08	–	githubexploit
GithubExploit	Exploit for CVE-2020-4034	26 Jan 202220:32	–	githubexploit

Vulners

Node

microsoft cbl2_polkit_0.119-2Range<0.119-2

OR

microsoft cm1_polkit_0.116-6Range<0.116-6

30 Jan 2022 16:00Current

7.3High risk

Vulners AI Score7.3

CVSS 27.2

CVSS 3.17.8

EPSS0.88057

SSVC

polkit pkexec local privilege escalation environment variables setuid