CVE-2021-3560: high-severity vulnerability in polkit
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
96Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 7.8epss 22%
from disclosure to weaponsame day
Published on NVDFeb 16
1st PoCJun 27
metasploitJun 3
CISA KEV+450d
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Fixed
5 products (137 components)
Red Hat OpenShift Container Platform 4.7 · Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux BaseOS EUS (v. 8.1) · Red Hat Enterprise Linux BaseOS EUS (v. 8.2) · Red Hat Virtualization 4 Hypervisor for RHEL 8
Not affected
4 products (16 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 9 · RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Action required by CISAfederal deadline: 2023-06-02
Apply updates per vendor instructions.
In short
Polkit, a system tool that controls who can perform sensitive tasks, can be tricked into allowing unprivileged users to gain root access. An attacker could exploit this to create admin accounts or take full control of the system.
Technical detail
CVE-2021-3560 is a privilege escalation vulnerability in polkit's D-Bus credential validation logic (CWE-863). An unprivileged local attacker can bypass authorization checks through crafted D-Bus requests, gaining root privileges without proper authentication. This affects confidentiality, integrity, and availability of the system.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · polkitpublic PoCs found — 73✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/50011githubgithub.com/secnigma/CVE-2021-3560-Polkit-Privilege-Esclation★ 126githubgithub.com/Almorabea/Polkit-exploit★ 125githubgithub.com/RicterZ/CVE-2021-3560-Authentication-Agent★ 116githubgithub.com/swapravo/polkadots★ 82githubgithub.com/hakivvi/CVE-2021-3560★ 40githubgithub.com/winmin/CVE-2021-3560★ 25githubgithub.com/AssassinUKG/Polkit-CVE-2021-3560★ 24githubgithub.com/UNICORDev/exploit-CVE-2021-3560★ 12githubgithub.com/chenaotian/CVE-2021-3560★ 9githubgithub.com/0dayNinja/CVE-2021-3560★ 9githubgithub.com/f4T1H21/CVE-2021-3560-Polkit-DBus★ 8githubgithub.com/aancw/polkit-auto-exploit★ 5githubgithub.com/NeonWhiteRabbit/CVE-2021-3560★ 3githubgithub.com/BizarreLove/CVE-2021-3560★ 2githubgithub.com/LucasPDiniz/CVE-2021-3560★ 2githubgithub.com/Kyyomaa/CVE-2021-3560-EXPLOIT★ 2githubgithub.com/cpu0x00/CVE-2021-3560★ 2githubgithub.com/arcslash/exploit_CVE-2021-3560★ 1githubgithub.com/titusG85/SideWinder-Exploit★ 0githubgithub.com/MandipJoshi/CVE-2021-3560★ 0githubgithub.com/markyu0401/CVE-2021-3560-Polkit-Privilege-Escalation★ 0githubgithub.com/SeimuPVE/CVE-2021-3560_Polkit★ 0githubgithub.com/Jeanback1/CVE-2021-3560-exploit★ 0githubgithub.com/Antoine-MANTIS/POC-Bash-CVE-2021-3560★ 0githubgithub.com/iSTAR-Lab/CVE-2021-3560_PoC★ 0githubgithub.com/asepsaepdin/CVE-2021-3560★ 0githubgithub.com/TieuLong21Prosper/CVE-2021-3560★ 0githubgithub.com/adakoifman/CVE-2021-3560★ 0githubgithub.com/AntorDOS/CVE-2021-3560-Polkit-Privesc-Exploit★ 0githubgithub.com/curtishoughton/CVE-2021-3560★ 0githubgithub.com/admin-079/CVE-2021-3560★ 0githubgithub.com/WithinOneStem/POC-Bash-CVE-2021-3560★ 0githubgithub.com/yutasato88/CVE-2021-3560-PolkitPrivilegeEsclation★ 0githubgithub.com/pashayogi/ROOT-CVE-2021-3560★ 0githubgithub.com/realatharva15/polkit-CVE-2021-3560_writeup★ 0vulncheckvulncheck.com/xdb/9edd6cf6661bunverifiedvulncheckvulncheck.com/xdb/03ef3a3b59beunverifiedvulncheckvulncheck.com/xdb/8e823266bbd5unverifiedvulncheckvulncheck.com/xdb/c4eec5a4f4a8unverifiedvulncheckvulncheck.com/xdb/3c3962d97923unverifiedvulncheckvulncheck.com/xdb/e8100379c1b0unverifiedvulncheckvulncheck.com/xdb/03fa3b5da68dunverifiedvulncheckvulncheck.com/xdb/dd1aeadeb04funverifiedvulncheckvulncheck.com/xdb/0d4f1d0b0a97unverifiedvulncheckvulncheck.com/xdb/5458d4a55c6funverifiedvulncheckvulncheck.com/xdb/9e693b05320bunverifiedvulncheckvulncheck.com/xdb/4c9042d8ae10unverifiedvulncheckvulncheck.com/xdb/201ca3f02f33unverifiedvulncheckvulncheck.com/xdb/b9903bce0f77unverifiedvulncheckvulncheck.com/xdb/b9083d54f435unverifiedvulncheckvulncheck.com/xdb/ab99d39a10aeunverifiedvulncheckvulncheck.com/xdb/1a9fd1b14178unverifiedvulncheckvulncheck.com/xdb/fe5ce90a026funverifiedvulncheckvulncheck.com/xdb/d89126ce6bd4unverifiedvulncheckvulncheck.com/xdb/635680273494unverifiedvulncheckvulncheck.com/xdb/f006252e1faaunverifiedvulncheckvulncheck.com/xdb/e55338406838unverifiedvulncheckvulncheck.com/xdb/25e4e99ad519unverifiedvulncheckvulncheck.com/xdb/e4e946e08867unverifiedvulncheckvulncheck.com/xdb/d61c55d40a53unverifiedvulncheckvulncheck.com/xdb/eb01bdf5882cunverifiedvulncheckvulncheck.com/xdb/cd90ec71f715unverifiedvulncheckvulncheck.com/xdb/bed1611a3e31unverifiedvulncheckvulncheck.com/xdb/adc62bb25d2bunverifiedvulncheckvulncheck.com/xdb/1dc3b537ba07unverifiedvulncheckvulncheck.com/xdb/3d2f55cb3c32unverifiedvulncheckvulncheck.com/xdb/a53e8dee7421unverifiedvulncheckvulncheck.com/xdb/c279fbc11487unverifiedvulncheckvulncheck.com/xdb/8c1d0543f79dunverifiedvulncheckvulncheck.com/xdb/5b62a0ef03d4unverifiedcve_referencepacketstormsecurity.com/files/172836/polkit-Authentication-Bypass.htmlunverifiedcve_referencepacketstormsecurity.com/files/172846/Facebook-Fizz-Denial-Of-Service.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/172836/polkit-Authentication-Bypass.htmlhttp://packetstormsecurity.com/files/172846/Facebook-Fizz-Denial-Of-Service.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1961710https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3560