Polkit Local Privilege Escalation Vulnerability (CVE-2021-3560) Analysis & Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTMajor Linux distributions running polkit versions 0.113 through 0.118
Unprivileged local attackers can bypass D-Bus credential checks to escalate privileges to root and create unauthorized administrator accounts
Immediately update the polkit package to the patched version using the system package manager
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update the polkit package to the latest secure version using your distribution's package manager.
# For Red Hat / CentOS / Rocky Linux
sudo dnf update polkit -y
# For Debian / Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade polkit -y2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, stop and disable the polkit service as a temporary mitigation. Note that this may impact system services relying on polkit.
# Stop and disable polkit service
sudo systemctl stop polkit
sudo systemctl disable polkit3. Log Audit & IoC Verification Commands
Check the installed polkit version and inspect system authentication logs for potential exploitation attempts or unauthorized user creation.
# Check polkit version
pkaction --version
# Search for exploitation indicators in authentication logs
sudo grep -E 'Error registration|Created user' /var/log/auth.log /var/log/secure 2>/dev/nullBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-3560) is a local privilege escalation (LPE) flaw in polkit (formerly PolicyKit), a component used in Linux operating systems to control system-wide privileges. When a process requests an authorized action via D-Bus, polkit queries the D-Bus daemon to verify the UID of the requesting process. Due to improper handling of exceptional conditions (CWE-754) and incorrect authorization (CWE-863), if the requesting process terminates the connection prematurely before polkit completes the lookup, polkit fails to retrieve the sender's credentials.
2. Exploitation Mechanics & Attack Scenario
An attacker initiates a privileged system action (such as creating a new local user with sudo privileges) using dbus-send and immediately kills the process while polkit is processing the request. When polkit queries D-Bus for the connection's UID, D-Bus returns an error because the connection no longer exists. Instead of handling this error and rejecting the request, polkit mistakenly treats the unidentifiable requester's UID as '0' (root). This bypasses authentication checks, allowing the requested action to execute with root privileges.
3. Infrastructure & Business Impact
With a CVSS score of 7.8 (High) and inclusion in the CISA KEV catalog, this vulnerability poses a severe threat to enterprise Linux environments. A local attacker with basic shell access can achieve full root compromise within seconds using simple command-line tools. This compromises the confidentiality, integrity, and availability of the host system, potentially leading to complete infrastructure takeover in shared hosting or containerized environments.
Official Vendor Advisories & References
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Frequently Asked SecOps Questions (CVE-2021-3560)
FAQQ1. How critical is CVE-2021-3560 and is it actively exploited in the wild?
CVE-2021-3560 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 22.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-3560?
Primary impacted vendors include polkit, redhat, debian, ubuntu, suse across polkit. Scope summary: Linux distributions running polkit versions 0.113 through 0.118 (including RHEL 8, Ubuntu 20.04 LTS, and Debian 11)
Q3. What temporary mitigations or workarounds exist for CVE-2021-3560 before patching?
[Mitigation] Immediately update the polkit package to the patched version using the system package manager Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-3560
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (polkit)
View Category →PHP Remote Code Execution (RCE) via OOM Memory Corruption (CVE-2026-109618)
[Affected Scope] All web applications and server environments running on the PHP engine.
GNOME json-glib Infinite Loop Denial of Service Vulnerability (CVE-2026-120194) Technical Advisory
[Affected Scope] Applications and systems utilizing the GNOME json-glib library to evaluate user-controlled JSONPath queries via json_path_query()
GNOME Epiphany Browser Permission Bypass and Unauthorized Camera/Microphone Access Vulnerability (CVE-2026-118598)
[Affected Scope] GNOME Epiphany browser versions 45.0 through at least 51.x
Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.