Skip to content
Fencer Vulns
high 7.8

CVE-2021-3560 kev in the critical feed json

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requesto…

published 2022-02-16 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-26871

cvss
7.8
version 3.1, CNA
cisa kev
Exploited
added 2023-05-12
epss
22.2%
EPSS 22.2% chance of exploitation in 30 days, percentile 97%
public exploits
2
Metasploit, Exploit-DB

Summary

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • polkit_project polkit 0.119
  • policykit-1 Debian 14, Debian 13, Debian 12 0.105-31

debian advisories DEBIAN-CVE-2021-3560

  • policykit-1 Ubuntu 20.04 LTS 0.105-26ubuntu1.1
  • policykit-1 Ubuntu 22.04 LTS 0.105-31

ubuntu advisories UBUNTU-CVE-2021-3560

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dhcp openshift 4.7 12:4.3.6-41.el8_3.1
  • cri-o openshift 4.7 1.20.3-6.rhaos4.7.git0d0f863.el7
  • cri-o openshift 4.7 1.20.3-6.rhaos4.7.git0d0f863.el8
  • polkit openshift 4.7 0.115-11.el8_3.2
  • dhcp-libs openshift 4.7 12:4.3.6-41.el8_3.1
  • dhcp-client openshift 4.7 12:4.3.6-41.el8_3.1
  • dhcp-common openshift 4.7 12:4.3.6-41.el8_3.1
  • polkit-libs openshift 4.7 0.115-11.el8_3.2

red hat advisories RHSA-2021:2555RHSA-2021:2522RHSA-2021:2238RHSA-2021:2237RHSA-2021:2236

  • polkit SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +10 more 0.114-3.12.1
  • polkit SLE Module for Basesystem 15 SP3, SLE Module for Basesystem 15 SP2, SLE Micro 5.0 0.116-3.3.1
  • polkit SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +12 more 0.113-5.21.1

suse advisories SUSE-SU-2021:1844-1SUSE-SU-2021:1843-1SUSE-SU-2021:1842-1

  • polkit openSUSE Tumbleweed 0.118-7.2
  • polkit openSUSE Leap 15.3 0.116-3.3.1
  • polkit openSUSE Leap 15.2 0.116-lp152.2.3.1

opensuse advisories openSUSE-SU-2024:11180-1openSUSE-SU-2021:1843-1openSUSE-SU-2021:0838-1

  • polkit Rocky Linux 8 0.115-11.el8_4.1

rocky linux advisories RLSA-2021:2238

  • polkit Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 0.119-r0

alpine advisories ALPINE-CVE-2021-3560

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • polkit Arch Linux 0.119-1

arch linux advisories AVG-2028

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3560 updated cvss 7.8

polkit: local privilege escalation using polkit_system_bus_name_get_creds_sync()

  • Red Hat Enterprise Linux BaseOS (v. 8) polkit 0.115-11.el8_4.1, polkit-libs 0.115-11.el8_4.1
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2021:2238
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.1) polkit 0.115-9.el8_1.1, polkit-libs 0.115-9.el8_1.1
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2021:2236
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) polkit 0.115-11.el8_2.1, polkit-libs 0.115-11.el8_2.1
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2021:2237
  • Red Hat OpenShift Container Platform 4.7 dhcp 4.3.6-41.el8_3.1, polkit 0.115-11.el8_3.2, dhcp-libs 4.3.6-41.el8_3.1, dhcp-client 4.3.6-41.el8_3.1, dhcp-common 4.3.6-41.el8_3.1, polkit-libs 0.115-11.el8_3.2, +11 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2021:2555
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host 4.4.6-20210615.0.el8_4, redhat-virtualization-host-image-update 4.4.6-20210615.0.el8_4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2021:2522
  • Red Hat Enterprise Linux 6 polkit, polkit-desktop-policy Red Hat Enterprise Linux 7 polkit Red Hat Enterprise Linux 9 polkit, polkit-libs Red Hat RHEL 8-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.4.6-2.el8ev, redhat-virtualization-host-image-update-placeholder 4.4.6-2.el8ev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/linux/local/polkit_dbus_auth_bypass)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
3 y ago
Patch by
2023-06-02 (3 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
Red Hat, Polkit
CISA name
Red Hat Polkit Incorrect Authorization Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

22.19% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • n/a polkit

Classification

Weakness
  • CWE-863 Incorrect Authorization
  • CWE-754 Improper Check for Unusual or Exceptional Conditions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.