CVE-2021-4034: polkit pkexec argument handling flaw allows local root escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityA locally exploitable setuid flaw giving root, with public exploit code, KEV listing and ransomware association, and an EPSS probability above 0.94.

What it is

pkexec, the setuid polkit utility for running commands as privileged users, mishandles the calling parameter count and ends up treating environment variables as commands. This out-of-bounds read and write lets a local unprivileged user induce pkexec to execute arbitrary code. Because pkexec is setuid and widely shipped across major Linux distributions, any local foothold can be turned into administrative rights.

Impact

An attacker with an unprivileged local account gains administrative (root) rights on the target machine. That enables full control of the host, including credential access, persistence and lateral movement.

Attack surface

Reached locally by executing the setuid pkexec binary with crafted environment variables; no network access, no authentication and no user interaction are required beyond the ability to run a process as an unprivileged user. The CVSS vector AV:L/AC:L/PR:L/UI:N confirms local, low-complexity, low-privilege, no-interaction exploitation.

Exploitation

Listed in CISA KEV with a due date of 2022-07-18 and flagged for known ransomware campaign use, and EPSS is 0.94921 (99.856th percentile). Multiple references are tagged Exploit, including the Qualys PwnKit writeup and Packet Storm entries, so public exploit code exists.

What to do

• Apply vendor patches for polkit/pkexec (for example the upstream freedesktop commit and Red Hat, Oracle, SUSE, Siemens and StarWind advisories) as the first action.
• If patching cannot be done immediately, remove the setuid bit from pkexec or restrict its execution to trusted users, per vendor mitigation guidance.
• Inventory all Linux hosts and images for the affected pkexec binary and track them to a patched state.
• Limit and monitor local interactive access, since exploitation requires only an unprivileged local account.
• Re-check container and appliance images that bundle polkit, as they may carry the vulnerable binary.

Detection

• Alert on execution of pkexec by non-root users, especially with unusual or empty environment variables.
• Monitor process trees where pkexec spawns unexpected child processes or shells.
• Watch for privilege changes to uid 0 originating from pkexec outside normal administrative workflows.
• Hunt for known PwnKit exploit artifacts and command patterns referenced in public exploit writeups.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.