Exploited vulnerability · CISA KEV

Is CVE-2021-4034 exploited? Yes: in CISA KEV since 27 Jun 2022

Gociux · Red Hat Polkit · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2021-4034, Red Hat Polkit Out-of-Bounds Read and Write Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 27 Jun 2022, 150 days after it was published. It is known to be used in ransomware campaigns. It affects Red Hat Polkit. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.

What to do

1. Check whether you run it. Look for Polkit in your asset inventory, including appliances and cloud images. Stack check lists every exploited Red Hat CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 28 Jan 2022.
4. Get told next time. Email alerts when CISA adds a CVE for Red Hat.

Other exploited CVEs in Polkit

• CVE-2021-3560: Red Hat Polkit Incorrect Authorization Vulnerability (12 May 2023)

References

• nvd.nist.gov/vuln/detail/CVE-2021-4034

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in June 2022 · Red Hat scorecard · act-now radar.