Overview
- Description
- A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
- Source
- secalert@redhat.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 7.8
- Impact score
- 5.9
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 7.2
- Impact score
- 10
- Exploitability score
- 3.9
- Vector string
- AV:L/AC:L/Au:N/C:C/I:C/A:C
Known exploits
Data from CISA
- Vulnerability name
- Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
- Exploit added on
- Jun 27, 2022
- Exploit action due
- Jul 18, 2022
- Required action
- Apply updates per vendor instructions.
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:polkit_project:polkit:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F01D94C9-1E04-413B-8636-1AAC6D9E84D6",
"versionEndExcluding": "121"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CB70A2F8-EAB3-4898-9353-F679FF721C82"
},
{
"criteria": "cpe:2.3:a:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB3AC848-C2D0-4878-8619-F5815173555D"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33C068A4-3780-4EAB-A937-6082DF847564"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "831F0F47-3565-4763-B16F-C87B1FF2035E"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "566507B6-AC95-47F7-A3FB-C6F414E45F51"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "87C21FE1-EA5C-498F-9C6C-D05F91A88217"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0AB105EC-19F9-424A-86F1-305A6FD74A9C"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C9BD9AE-46FC-4609-8D99-A3CFE91D58D1"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1CDCFF34-6F1D-45A1-BE37-6A0E17B04801"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4A684C7-88FD-43C4-9BDB-AE337FCBD0AB"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "47811209-5CE5-4375-8391-B0A7F6A0E420"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8EB6F417-25D0-4A28-B7BA-D21929EAA9E9"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E5C80DB2-4A78-4EC9-B2A8-1E4D902C4834"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "983533DD-3970-4A37-9A9C-582BD48AA1E5"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "37CE1DC7-72C5-483C-8921-0B462C8284D1"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9BBCD86A-E6C7-4444-9D74-F861084090F0"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "98381E61-F082-4302-B51F-5648884F998B"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D99A687E-EAE6-417E-A88E-D0082BC194CD"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B353CE99-D57C-465B-AAB0-73EF581127D1"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7431ABC1-9252-419E-8CC1-311B41360078"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6897676D-53F9-45B3-B27F-7FF9A4C58D33"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E28F226A-CBC7-4A32-BE58-398FA5B42481"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_eus:8.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "61917784-47F1-4328-BA1F-A88C5E23496B"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B76AA310-FEC7-497F-AF04-C3EC1E76C4CC"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17F256A9-D3B9-4C72-B013-4EFD878BFEA8"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B09ACF2D-D83F-4A86-8185-9569605D8EE1"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AC10D919-57FD-4725-B8D2-39ECB476902F"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "48C2E003-A71C-4D06-B8B3-F93160568182"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3921C1CF-A16D-4727-99AD-03EFFA7C91CA"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BC6DD887-9744-43EA-8B3C-44C6B6339590"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "825ECE2D-E232-46E0-A047-074B34DB1E97"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
"vulnerable": true,
"matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"vulnerable": true,
"matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
"vulnerable": true,
"matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AAE4D2D0-CEEB-416F-8BC5-A7987DF56190"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:enterprise_storage:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7305944-AC9C-47A3-AADF-71A8B24830D1"
},
{
"criteria": "cpe:2.3:a:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CDFEA8DC-7D78-4ACD-A95C-9408F45EEAE7"
},
{
"criteria": "cpe:2.3:a:suse:manager_proxy:4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9910C73A-3BCD-4F56-8C7D-79CB289640A2"
},
{
"criteria": "cpe:2.3:a:suse:manager_server:4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5810E98-7BF5-42E2-9DE9-661049ABE367"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:15:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C4F62C0-4188-433A-8292-559025CA23C0"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:*:-:*:*",
"vulnerable": true,
"matchCriteriaId": "07D416C5-4A0F-4EF3-A3DE-A028AAA4F739"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:*:sap:*:*",
"vulnerable": true,
"matchCriteriaId": "F6C1736B-0505-4C19-98B7-90C8359F3BCD"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "243B9B56-C744-4C1C-B42E-158C1B041B6A"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DFC79B17-E9D2-44D5-93ED-2F959E7A3D43"
},
{
"criteria": "cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD04BEE5-E9A8-4584-A68C-0195CE9C402C"
},
{
"criteria": "cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D3E503FB-6279-4D4A-91D8-E237ECF9D2B0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:siemens:sinumerik_edge:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D069EA07-88A5-4058-A2BC-44F94D9ACC9A",
"versionEndExcluding": "3.3.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:scalance_lpe9403_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9FC41AD4-69E5-48D8-8216-671F485C3C40",
"versionEndExcluding": "2.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:scalance_lpe9403:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "52A77C9D-E59C-4397-B834-797D7B334A6B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:starwindsoftware:command_center:1.0:update3_build5871:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B323EF31-7A67-4458-8323-86F8AA58268C"
},
{
"criteria": "cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build14338:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "14AF427F-BC75-40C7-9579-34A74E2E475D"
}
],
"operator": "OR"
}
]
}
]