Researchers find a 12-year-old vulnerability in Polkit that local attackers can use to gain root privileges on all major Linux distributions; an exploit is out
BleepingComputer Ionut Ilascu
Related Coverage
- PwnKit: Local Privilege Escalation Vulnerability Discovered in polkit's pkexec (CVE-2021-4034) Qualys Security Blog
- 12-year-old Linux root privilege flaw has been “hiding in plain sight” IT PRO
- PwnKit: Local Privilege Escalation bug affects major Linux distros Security Affairs
- This easily exploitable bug affects all Linux distros TechRadar
- Local privilege escalation vulnerability found on ‘polkit’ program found on every Linux variant scmagazine.com
- 12-year-old vulnerability in Linux gives attackers root privileges SiliconANGLE
- Pwnkit is an easy-to-exploit vulnerability affecting all Linux distros Gizchina
Discussion
-
@nsa_csdirector
Rob Joyce
on x
#CVE-2021-4034 in a system tool called Polkit has me concerned. Easy and reliable privilege escalation preinstalled on every major Linux distribution. Patch ASAP or use the simple chmod 0755 /usr/bin/pkexec mitigation. There are working POCs in the wild. https://arstechnica.com/.…
-
@zcobb
@zcobb
on x
Fortunately, Linux is not used in any mission critical systems, like self-driving cars and AI-based medical diagnostics, so no problem...oh...wait... https://arstechnica.com/...
-
@arstechnica
@arstechnica
on x
A 12-year-old, easy-to-exploit Linux bug gives attackers root privilege on machines running any major distribution of the operating system. https://arstechnica.com/...
-
@craighrowland
@craighrowland
on x
root exploits on Linux are not a big deal. I have told people for ages that if someone gets on a Linux box you just need to assume the got root and proceed accordingly. In fact, just assume any intruder is admin on any compromised OS. It's easier to deal with reality this way. ht…
-
@kylebrussell
Kyle Russell
on x
me reading this headline: “why did they give some 12 y.o. kid who likes Linux this kind of power?” https://twitter.com/...
-
@marcan42
Hector Martin
on x
Sigh. We need to stop writing security-critical code in C. https://twitter.com/...
-
@mandy_seley
Mandy Seley
on x
Still working late, this week is cursed. Woke up before my alarm to a new flurry of message notifications - plus, there's a new widespread Linux vulnerability (linked fyi). How is it only Wednesday. https://blog.qualys.com/...
-
@ryanaraine
Ryan Naraine
on x
New from Qualys: Memory corruption in a SUID-root program installed by default on every major Linux distribution. Easy to exploit, allows unprivileged user to gain full root privileges on a vulnerable host by exploiting vuln in its default configuration https://blog.qualys.com/..…
-
@alyssam_infosec
@alyssam_infosec
on x
Probably a good day to take a look at your Linux systems. If there's no patch available for the OS, a simple chmod provides a pretty effective mitigation. https://blog.qualys.com/...
-
@bsdphk
Poul-Henning Kamp
on x
No, we need hardware which securely supports the architectural model we write our code against. Good news: It exists now: https://msrc-blog.microsoft.com/ ... https://twitter.com/...
-
@__phantomderp
@__phantomderp
on x
> Therefore: > > at line 534, the integer n is permanently set to 1; > at line 610, the pointer path is read out-of-bounds from argv[1]; > at line 639, the pointer s is written out-of-bounds to argv[1]. I'm gonna fucking S C R E A M . https://twitter.com/...