CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability

High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-27. EPSS: 94.3% chance of exploitation in the next 30 days.

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

Affected products

Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 20.04 only; version 21.10 only
Oracle HTTP Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only
Oracle ZFS Storage Appliance Kit: version 8.8 only
Polkit Project Polkit: before 121 (fixed in 121)
Red Hat Enterprise Linux: version 8.0 only
Red Hat Enterprise Linux Desktop: version 7.0 only
Red Hat Enterprise Linux Eus: version 8.2 only
Red Hat Enterprise Linux For IBM Z Systems: version 7.0 only; version 8.0 only
Red Hat Enterprise Linux For IBM Z Systems Eus: version 8.2 only; version 8.4 only
Red Hat Enterprise Linux For Power Big Endian: version 7.0 only
Red Hat Enterprise Linux For Power Little Endian: version 7.0 only; version 8.0 only
Red Hat Enterprise Linux For Power Little Endian Eus: version 8.1 only; version 8.2 only; version 8.4 only
Red Hat Enterprise Linux For Scientific Computing: version 7.0 only
Red Hat Enterprise Linux Server: version 6.0 only; version 7.0 only
Red Hat Enterprise Linux Server Aus: version 7.3 only; version 7.4 only; version 7.6 only; version 7.7 only; version 8.2 only; version 8.4 only
Red Hat Enterprise Linux Server Eus: version 8.4 only
Red Hat Enterprise Linux Server Tus: version 7.6 only; version 7.7 only; version 8.2 only; version 8.4 only
Red Hat Enterprise Linux Server Update Services For SAP Solutions: version 7.6 only; version 7.7 only; version 8.1 only; version 8.2 only; version 8.4 only
Red Hat Enterprise Linux Workstation: version 7.0 only
Siemens Scalance LPE9403 Firmware: before 2.0 (fixed in 2.0)
Siemens Sinumerik Edge: before 3.3.0 (fixed in 3.3.0)
Starwindsoftware Command Center: version 1.0 only
Starwindsoftware Starwind Virtual San: version v8 only
Suse Enterprise Storage: version 7.0 only
Suse Linux Enterprise Desktop: version 15 only
and 5 more

Published 2022-01-28. Last modified 2026-08-15.