# CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability

- Exploited (CISA KEV): yes, added 2022-06-27, known ransomware use
- Published: 2022-01-28
- CVSS: 7.8 HIGH (v3.1)
- EPSS: 94.9% (100th percentile)
- CWE: CWE-787

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Before feed history | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | Before feed history | — | — |

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2021-4034 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2021-4034