Files

T

leviathan 43e290b224 Phase 7: Pwnkit (CVE-2021-4034) detect-only module

First USERSPACE LPE in IAMROOT (every prior module is kernel). Same
iamroot_module interface — the difference is the affected-version
check is package-version-based rather than kernel-version-based.

- modules/pwnkit_cve_2021_4034/:
  - iamroot_modules.{c,h}: detect() locates setuid pkexec (one of
    /usr/bin/pkexec, /usr/sbin/pkexec, /bin/pkexec, /sbin/pkexec,
    /usr/local/bin/pkexec) and parses 'pkexec --version' output.
    Handles BOTH version-string formats: legacy '0.105'/'0.120'
    (older polkit) AND modern bare-integer '121'/'126' (post-0.121
    rename to single-number scheme). Reports VULNERABLE on parse
    failure (conservative).
  - exploit() returns IAMROOT_PRECOND_FAIL with a 'not yet
    implemented' message; full Qualys-PoC follow-up is the next
    commit. ~200 lines including embedded .so generator.
  - MODULE.md documents the bug, affected ranges, distro backport
    landscape (RHEL 7/8, Ubuntu focal/impish, Debian buster/bullseye
    each have their own backported polkit version).
  - Embedded auditd + sigma detection rules:
    auditd: pkexec watch + execve audit
    sigma:  pkexec invocation + suspicious env (GCONV_PATH, CHARSET)

- core/registry.h adds iamroot_register_pwnkit() declaration.
- iamroot.c main() registers pwnkit.
- Makefile gains the pwnkit family as a separate object set.

Verified end-to-end on kctf-mgr (modern polkit 126):
  iamroot --list  → 8 modules
  iamroot --scan  → pwnkit reports 'version 126 ≥ 0.121 (fixed)'
  iamroot --detect-rules --format=auditd | grep pwnkit → emits

2026-05-16 20:07:40 -04:00

2.2 KiB

Raw Blame History

Pwnkit — CVE-2021-4034

🔵 DETECT-ONLY as of 2026-05-16. Full exploit follows.

Summary

Polkit's pkexec parses argv assuming argc ≥ 1. With argc == 0, the parsing reads past argv[0] into the contiguous envp region, treating the first env string as if it were argv[0]. By placing GCONV_PATH= crafted entries in the environment and naming a controlled file such that libc's iconv() loads it as a gconv module, an unprivileged user gets code execution as root via the setuid pkexec binary.

Disclosed by Qualys 2022-01-25. Bug existed since pkexec's first release in 2009 — affects every distribution shipping a vulnerable polkit until 0.121 (or distro backport).

Affected versions

All polkit ≤ 0.120 (i.e., pkexec from 2009 onward) before the fix landed.
Patched in upstream polkit 0.121 (2022-01-25).
Distro backports vary:
- Ubuntu: 0.105-26ubuntu1.3 (focal), 0.105-31ubuntu0.1 (impish), etc.
- Debian: 0.105-31+deb11u1 (bullseye), 0.105-26+deb10u1 (buster)
- RHEL: polkit-0.115-13.el7_9 (RHEL 7), polkit-0.117-9.el8_5.1 (RHEL 8)

IAMROOT detect logic (current)

Resolve pkexec binary (/usr/bin/pkexec or which pkexec)
If not present → IAMROOT_OK (no attack surface)
Run pkexec --version and parse version
Compare to known-fixed thresholds; report VULNERABLE if below

Exploit logic (follow-up)

Canonical Qualys / public Pwnkit PoC:

Build a malicious shared object that exit(setuid(0)); system("/bin/sh")
Build a GCONV_PATH=./X env entry plus CHARSET=X so libc's iconv (used by pkexec for argv decoding) loads our .so
execve("/usr/bin/pkexec", { NULL }, envp) — argc=0 triggers the read past argv[0], which sees our GCONV_PATH crafted string, then pkexec gives us root context, the gconv module loads our .so as root, we drop to a shell

~200 lines including the embedded .so generator. Phase 7 follow-up commit lands the full version.

Detection rules (shipped)

detect/auditd.rules — flags pkexec invocations from non-root.

2.2 KiB Raw Blame History