berdav/CVE-2021-4034
FreeCVE-2021-4034 1day
FreeFree tier
About berdav/CVE-2021-4034
An open-source proof-of-concept exploit for CVE-2021-4034, a privilege escalation vulnerability in Polkit's pkexec component on Linux systems. The exploit allows a local unprivileged user to gain a root shell by leveraging an out-of-bounds write in the pkexec binary. It includes a dry-run mode for safe vulnerability testing, a one-liner script for quick exploitation, and provides mitigation guidance such as removing the SUID-bit from pkexec.
Key Features
Privilege escalation via Polkit pkexec vulnerability (CVE-2021-4034)
Dry-run mode to safely test if system is vulnerable
One-liner command for quick exploitation using a shell script
Simple compilation: just run 'make' and execute the binary
Includes mitigation advice: remove SUID-bit from pkexec
Pros & Cons
Pros
- Simple to use: compile and execute to get root shell
- Includes dry-run mode for non-destructive testing
- Provides clear mitigation advice for unpatched systems
- Open source and freely available on GitHub
- Actively maintained with 2k stars and 507 forks
Cons
- Only works on unpatched systems (patched by most distro updates)
- Requires local access to the target system to execute
- Can be used maliciously for unauthorized privilege escalation
- Limited to Linux systems using Polkit
Best For
Security testing and vulnerability assessment of Linux systemsDemonstration of privilege escalation attack vectorEducational research on polkit vulnerabilitiesPenetration testing (with proper authorization)
FAQ
How can I test if my system is vulnerable without gaining a root shell?
Compile the dry-run target using 'make dry-run' and run the resulting binary. If it prints 'root', your system is vulnerable. If it shows an error or usage message, the system is patched.
How do I mitigate CVE-2021-4034 if no patches are available?
As a temporary mitigation, remove the SUID-bit from pkexec by running 'sudo chmod 0755 /usr/bin/pkexec'. This will cause the exploit to fail.
Does the exploit work on all Linux distributions?
It works on any Linux system with a vulnerable version of pkexec that has the SUID-bit set. Most distributions have released patches; update your system to fix.