Polkit pkexec Local Privilege Escalation (LPE) Vulnerability Analysis and Mitigation Guide (PwnKit, CVE-2021-4034)

1. Vulnerability Overview & Root Cause

This vulnerability, widely known as 'PwnKit', is an out-of-bounds write/read vulnerability (CWE-787, CWE-125) in Polkit's pkexec utility, a SUID-root program installed by default on most Linux distributions. The root cause lies in the improper handling of command-line arguments (argc) within pkexec. When the utility is executed with an empty argument list (argc = 0), pkexec incorrectly assumes argv is the process name and attempts to read/write beyond the bounds of the array, effectively accessing the environment variables array (envp) instead.

2. Exploitation Mechanics & Attack Scenario

An attacker invokes pkexec using the execve() system call with an empty argv array (argc = 0) and crafts a malicious envp array containing specific environment variables. Because pkexec treats envp as argv, the attacker can manipulate the application's internal state to inject dangerous environment variables, such as GCONV_PATH, which are normally cleared by the dynamic linker for SUID binaries. This allows the attacker to force pkexec to load and execute an arbitrary shared library (.so) with root privileges, resulting in an immediate local root shell.

3. Infrastructure & Business Impact

With a CVSS score of 7.8 (High) and inclusion in the CISA KEV catalog, this vulnerability poses a severe threat to enterprise infrastructure. While it requires local access to be exploited, it is highly sought after by threat actors as a secondary payload. Once an attacker gains initial access via web application exploits (e.g., RCE) or compromised credentials, PwnKit provides a reliable, 100% successful path to full system compromise, potentially leading to data exfiltration, ransomware deployment, or container escape.