polkit: local privilege escalation using polkit_system_bus_name_get_creds_sync()

🗓️ 22 Jun 2021 14:57:03Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

Polkit local privilege escalation bypasses bus system credential checks, enabling root for unprivileged users.

Reporter	Title	Published	Views	Family All 165
GithubExploit	lpe-toolkit	21 May 202619:33	–	githubexploit
GithubExploit	Exploit for Improper Privilege Management in Sudo_Project Sudo	10 Jul 202306:38	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Polkit_Project Polkit	29 Apr 202218:57	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Microsoft	11 Jul 202309:29	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Polkit_Project Polkit	17 Apr 202615:59	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Polkit_Project Polkit	8 Nov 202305:11	–	githubexploit
GithubExploit	Exploit for Improper Check for Unusual or Exceptional Conditions in Polkit_Project Polkit	17 Dec 202515:21	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Polkit_Project Polkit	30 Apr 202205:53	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Polkit_Project Polkit	11 Jun 202114:28	–	githubexploit
GithubExploit	Exploit for Incorrect Authorization in Polkit_Project Polkit	27 May 202600:42	–	githubexploit

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8.4	x86_64	redhat-virtualization-host-image-update	4.4.6-20210615.0.el8_4	redhat-virtualization-host-image-update-4.4.6-20210615.0.el8_4.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-3560
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-3560
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
cve	www.cve.org/CVERecord

28 Jun 2026 12:34Current

7.2High risk

Vulners AI Score7.2

CVSS 27.2

CVSS 3.17.8

EPSS0.22193

SSVC

polkit local privilege escalation credential checks bypass root privileges unprivileged attacker local administrator data confidentiality system availability message bus unix