Saint PwnKit, Who Gave Root to Passers-by

Patron of setuid programs, people who count arguments starting from one, and bugs that wait twelve years.

Life

On 25 January 2022 Qualys revealed that pkexec, part of polkit and present in almost every Linux distribution, got confused when launched without a single argument. Reading past the end of the list, it mistook environment variables for arguments and handed root privileges to any local user. The flaw had been there since 2009.

Prayer

O Saint PwnKit, who gave root to anyone with nothing to say, teach our setuid programs to check argc. Amen.

How to celebrate

Celebrated by updating polkit or, for the hastiest devotees, removing the setuid bit from pkexec.

Say nothing, and sometimes you get everything.

Technical record

Disclosed on: January 25 2022
CVE: CVE-2021-4034
CVSS: 7.8Actively exploited (CISA KEV)
Product: Red Hat · polkit

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

Sources: blog.qualys.com · github.com

Canonized by Pope Follina I

Saint PwnKit, Who Gave Root to Passers-by

Life

Prayer

How to celebrate

Technical record

Related saints

The “pwn” family

Same year: 2022