CVE-2021-4034 kev+ ransomware in the critical feed json
A local privilege escalation vulnerability was found on polkit's pkexec utility.
published 2022-01-28 4 y ago modified 2026-08-15 2 mo ago also EUVD-2021-33934
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2022-06-27, used in ransomware
- epss
- 94.9%
- EPSS 94.9% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 2
- Metasploit, Exploit-DB
Summary
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
Patch / fix
cisa required action Apply updates per vendor instructions.
- polkit_project polkit 121
- siemens sinumerik_edge 3.3.0
- siemens scalance_lpe9403_firmware 2.0
- policykit-1 Debian 14, Debian 13, Debian 12 0.105-31.1
debian advisories DEBIAN-CVE-2021-4034
- policykit-1 Ubuntu 18.04 LTS 0.105-20ubuntu0.18.04.6
- policykit-1 Ubuntu 20.04 LTS 0.105-26ubuntu1.2
- policykit-1 Ubuntu 22.04 LTS 0.105-31ubuntu1
- policykit-1 Ubuntu Pro 14.04 LTS 0.105-4ubuntu3.14.04.6+esm1
- policykit-1 Ubuntu Pro 16.04 LTS 0.105-14.1ubuntu0.5+esm1
ubuntu advisories UBUNTU-CVE-2021-4034
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- redhat-virtualization-host RHEL 7 4.3.21-20220126.0.el7_9
- redhat-virtualization-host-image-update RHEL 7 4.3.21-20220126.0.el7_9
- redhat-virtualization-host rhev hypervisor 4.4 4.4.10-202202081536_8.5
- redhat-virtualization-host-image-update rhev hypervisor 4.4 4.4.10-202202081536_8.5
- polkit RHEL 7 0.112-26.el7_9.1
- polkit RHEL 8 0.115-13.el8_5.1
- polkit-libs RHEL 8 0.115-13.el8_5.1
- polkit RHEL 8.2 EUS 0.115-11.el8_2.2
red hat advisories RHSA-2022:0443RHSA-2022:0540RHSA-2022:0265RHSA-2022:0266RHSA-2022:0269RHSA-2022:0270
- polkit SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +7 more 0.114-3.15.1
- polkit SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +9 more 0.116-3.6.1
- polkit SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +12 more 0.113-5.24.1
suse advisories SUSE-SU-2022:0191-1SUSE-SU-2022:0190-1SUSE-SU-2022:0189-1
- polkit openSUSE Tumbleweed 0.120-2.1
- polkit openSUSE Leap 15.3 0.116-3.6.1
opensuse advisories openSUSE-SU-2024:11780-1openSUSE-SU-2022:0190-1
- polkit AlmaLinux 8 0.115-13.el8_5.2
- polkit-libs AlmaLinux 8 0.115-13.el8_5.2
almalinux advisories ALSA-2022:0267
- polkit Rocky Linux 8 0.115-13.el8_5.1
rocky linux advisories RLSA-2022:0267
- polkit Alpine 3.15 0.119-r8
- polkit Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 0.120-r2
alpine advisories ALPINE-CVE-2021-4034
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- polkit CBL-Mariner 2.0 0.119-2
azure linux advisories AZL-8335
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- polkit Arch Linux 0.120-5
arch linux advisories AVG-2654
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2021-4034 updated cvss 7.8
polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector
-
Red Hat Enterprise Linux BaseOS (v. 8) polkit 0.115-13.el8_5.1, polkit-libs 0.115-13.el8_5.1fixed: vendor fix RHSA-2022:0267
-
Red Hat Enterprise Linux BaseOS E4S (v. 8.1) polkit 0.115-9.el8_1.2, polkit-libs 0.115-9.el8_1.2fixed: vendor fix RHSA-2022:0268
-
Red Hat Enterprise Linux BaseOS EUS (v. 8.2) polkit 0.115-11.el8_2.2, polkit-libs 0.115-11.el8_2.2fixed: vendor fix RHSA-2022:0265
-
Red Hat Enterprise Linux BaseOS EUS (v.8.4) polkit 0.115-11.el8_4.2, polkit-libs 0.115-11.el8_4.2fixed: vendor fix RHSA-2022:0266
-
Red Hat Enterprise Linux Client (v. 7) polkit 0.112-26.el7_9.1 Red Hat Enterprise Linux Client Optional (v. 7) polkit-docs 0.112-26.el7_9.1, polkit-devel 0.112-26.el7_9.1, polkit-debuginfo 0.112-26.el7_9.1 Red Hat Enterprise Linux ComputeNode Optional (v. 7) polkit-docs 0.112-26.el7_9.1, polkit-devel 0.112-26.el7_9.1, polkit-debuginfo 0.112-26.el7_9.1fixed: vendor fix RHSA-2022:0274
-
Red Hat Enterprise Linux Server (v. 6 ELS) polkit 0.96-11.el6_10.2, polkit-desktop-policy 0.96-11.el6_10.2fixed: vendor fix RHSA-2022:0269
-
Red Hat Enterprise Linux Server (v. 7) polkit 0.112-26.el7_9.1fixed: vendor fix RHSA-2022:0274
-
Red Hat Enterprise Linux Server AUS (v. 7.3) polkit 0.112-12.el7_3.1fixed: vendor fix RHSA-2022:0270
show 12 moreshow fewer
-
Red Hat Enterprise Linux Server AUS (v. 7.4) polkit 0.112-12.el7_4.2fixed: vendor fix RHSA-2022:0272
-
Red Hat Enterprise Linux Server AUS (v. 7.6) polkit 0.112-18.el7_6.3fixed: vendor fix RHSA-2022:0271
-
Red Hat Enterprise Linux Server AUS (v. 7.7) polkit 0.112-22.el7_7.2fixed: vendor fix RHSA-2022:0273
-
Red Hat Enterprise Linux Server E4S (v. 7.6) polkit 0.112-18.el7_6.3fixed: vendor fix RHSA-2022:0271
-
Red Hat Enterprise Linux Server E4S (v. 7.7) polkit 0.112-22.el7_7.2fixed: vendor fix RHSA-2022:0273
-
Red Hat Enterprise Linux Server TUS (v. 7.6) polkit 0.112-18.el7_6.3fixed: vendor fix RHSA-2022:0271
-
Red Hat Enterprise Linux Server TUS (v. 7.7) polkit 0.112-22.el7_7.2fixed: vendor fix RHSA-2022:0273
-
Red Hat Enterprise Linux Workstation (v. 7) polkit 0.112-26.el7_9.1fixed: vendor fix RHSA-2022:0274
-
Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host 4.3.21-20220126.0.el7_9, redhat-virtualization-host-image-update 4.3.21-20220126.0.el7_9fixed: vendor fix RHSA-2022:0443
-
Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host 4.4.10-202202081536_8.5, redhat-virtualization-host-image-update 4.4.10-202202081536_8.5fixed: vendor fix RHSA-2022:0540
-
Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-virtualization-host 4.3.21-20220126.0.el7_9, redhat-virtualization-host-image-update 4.3.21-20220126.0.el7_9fixed: vendor fix RHSA-2022:0443
-
Red Hat Enterprise Linux 9 polkit, polkit-libs Red Hat Virtualization 4 Hypervisor for RHEL 8 wget 1.19.5-10.el8, libmetalink 0.1.3-7.el8 Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.3.21-1.el7ev, redhat-virtualization-host-image-update-placeholder 4.3.21-1.el7ev Red Hat RHEL 8-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.4.10-1.el8ev, redhat-release-virtualization-host-content 4.4.10-1.el8ev, redhat-virtualization-host-image-update-placeholder 4.4.10-1.el8evnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-23-075-01 updated cvss 7.8
Siemens SCALANCE, RUGGEDCOM Third-Party
-
Siemens RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) <V7.2 Siemens RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) <V7.2 Siemens SCALANCE M804PB (6GK5804-0AP00-2AA2) <V7.2 Siemens SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) <V7.2 Siemens SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) <V7.2 Siemens SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) <V7.2affected: fixed in V7.2 support.industry.siemens.com
+14 more productsfewer
Siemens SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) <V7.2 Siemens SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) <V7.2 Siemens SCALANCE M874-2 (6GK5874-2AA00-2AA2) <V7.2 Siemens SCALANCE M874-3 (6GK5874-3AA00-2AA2) <V7.2 Siemens SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) <V7.2 Siemens SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) <V7.2 Siemens SCALANCE M876-4 (6GK5876-4AA10-2BA2) <V7.2 Siemens SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) <V7.2 Siemens SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) <V7.2 Siemens SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) <V7.2 Siemens SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) <V7.2 Siemens SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) <V7.2 Siemens SCALANCE S615 (6GK5615-0AA00-2AA2) <V7.2 Siemens SCALANCE S615 EEC (6GK5615-0AA01-2AA2) <V7.2
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-22-270-02 updated cvss 7.8
Hitachi Energy APM Edge
-
Hitachi Energy Lumada APM Edge 3.0, 1.0, 4.0, 2.0affected: vendor fix, mitigation “Physically protect process control systems from unauthorized direct access.” search.abb.com
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
cisa ICSA-22-167-16 updated cvss 7.8
Siemens SCALANCE LPE 4903 and SINUMERIK Edge
-
Siemens SCALANCE LPE9403 <V2.0affected: fixed in V2.0, mitigation support.industry.siemens.com
-
Siemens SINUMERIK Edge <V3.3.0affected: fixed in V3.3.0, mitigation
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
Timeline
- First public exploit (Metasploit exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec)
- Published
- CISA SSVC: exploitation active
- Added to CISA KEV
- CISA patch deadline
Known exploited
- Added
- 4 y ago
- Patch by
- 2022-07-18 (4 y ago)
- Ransomware
- Known to be used in ransomware campaigns
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Red Hat, Polkit
- CISA name
- Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
Ransomware
Groups reported to have exploited it in intrusions.
- BlackCat ransomware gang
reported by crowdstrike.com
Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0
ATT&CK techniques
How it is exploited and what it leads to, in MITRE ATT&CK terms.
- T1068 Exploitation for Privilege Escalation exploitation
kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 4 y ago
Exploit prediction
94.92% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec Local Privilege Escalation in polkits pkexec metasploit exploit, excellent rank, 2022-01-25
- EDB-50689 PolicyKit-1 0.105-31 - Privilege Escalation local, 2022-01-27
- qualys.com https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt referenced PoC, tagged "exploit" by a source, unverified
- packetstormsecurity.com http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified
- secpod.com https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/ referenced PoC, tagged "exploit" by a source, unverified
- vicarius.io https://www.vicarius.io/vsociety/posts/pwnkit-pkexec-lpe-cve-2021-4034 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- n/a polkit
Classification
References
-
gitlab.freedesktop.org
/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683
patch
-
bugzilla.redhat.com
/show_bug.cgi?id=2025869
issue-tracking, patch
-
oracle.com
/security-alerts/cpuapr2022.html
patch, third-party-advisory
-
qualys.com
/2022/01/25/cve-2021-4034/pwnkit.txt
exploit, mitigation, third-party-advisory
-
packetstormsecurity.com
/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html
exploit, third-party-advisory, vdb-entry
-
secpod.com
/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/
exploit, third-party-advisory
-
vicarius.io
/vsociety/posts/pwnkit-pkexec-lpe-cve-2021-4034
exploit, third-party-advisory
-
access.redhat.com
/security/vulnerabilities/RHSB-2022-001
mitigation, vendor-advisory
-
packetstormsecurity.com
/files/166200/Polkit-pkexec-Privilege-Escalation.html
third-party-advisory, vdb-entry
-
suse.com
/support/kb/doc/?id=000020564
third-party-advisory
-
cert-portal.siemens.com
/productcert/pdf/ssa-330556.pdf
third-party-advisory
-
starwindsoftware.com
/security/sw-20220818-0001/
third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-4034
government-resource, us-government-resource
Sources
- CVE List CVE-2021-4034
- NVD CVE-2021-4034
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.