leviathan
43e290b224
First USERSPACE LPE in IAMROOT (every prior module is kernel). Same
iamroot_module interface — the difference is the affected-version
check is package-version-based rather than kernel-version-based.
- modules/pwnkit_cve_2021_4034/:
- iamroot_modules.{c,h}: detect() locates setuid pkexec (one of
/usr/bin/pkexec, /usr/sbin/pkexec, /bin/pkexec, /sbin/pkexec,
/usr/local/bin/pkexec) and parses 'pkexec --version' output.
Handles BOTH version-string formats: legacy '0.105'/'0.120'
(older polkit) AND modern bare-integer '121'/'126' (post-0.121
rename to single-number scheme). Reports VULNERABLE on parse
failure (conservative).
- exploit() returns IAMROOT_PRECOND_FAIL with a 'not yet
implemented' message; full Qualys-PoC follow-up is the next
commit. ~200 lines including embedded .so generator.
- MODULE.md documents the bug, affected ranges, distro backport
landscape (RHEL 7/8, Ubuntu focal/impish, Debian buster/bullseye
each have their own backported polkit version).
- Embedded auditd + sigma detection rules:
auditd: pkexec watch + execve audit
sigma: pkexec invocation + suspicious env (GCONV_PATH, CHARSET)
- core/registry.h adds iamroot_register_pwnkit() declaration.
- iamroot.c main() registers pwnkit.
- Makefile gains the pwnkit family as a separate object set.
Verified end-to-end on kctf-mgr (modern polkit 126):
iamroot --list → 8 modules
iamroot --scan → pwnkit reports 'version 126 ≥ 0.121 (fixed)'
iamroot --detect-rules --format=auditd | grep pwnkit → emits
58 lines
2.2 KiB
Markdown
58 lines
2.2 KiB
Markdown
# Pwnkit — CVE-2021-4034
|
|
|
|
> 🔵 **DETECT-ONLY** as of 2026-05-16. Full exploit follows.
|
|
|
|
## Summary
|
|
|
|
Polkit's `pkexec` parses argv assuming argc ≥ 1. With `argc == 0`, the
|
|
parsing reads past `argv[0]` into the contiguous envp region, treating
|
|
the first env string as if it were argv[0]. By placing `GCONV_PATH=`
|
|
crafted entries in the environment and naming a controlled file such
|
|
that libc's iconv() loads it as a gconv module, an unprivileged user
|
|
gets code execution as root via the setuid pkexec binary.
|
|
|
|
Disclosed by Qualys 2022-01-25. Bug existed since pkexec's first
|
|
release in 2009 — affects every distribution shipping a vulnerable
|
|
polkit until 0.121 (or distro backport).
|
|
|
|
## Affected versions
|
|
|
|
- **All polkit ≤ 0.120** (i.e., pkexec from 2009 onward) before the
|
|
fix landed.
|
|
- Patched in upstream **polkit 0.121** (2022-01-25).
|
|
- Distro backports vary:
|
|
- Ubuntu: 0.105-26ubuntu1.3 (focal), 0.105-31ubuntu0.1 (impish), etc.
|
|
- Debian: 0.105-31+deb11u1 (bullseye), 0.105-26+deb10u1 (buster)
|
|
- RHEL: polkit-0.115-13.el7_9 (RHEL 7), polkit-0.117-9.el8_5.1 (RHEL 8)
|
|
|
|
## IAMROOT detect logic (current)
|
|
|
|
1. Resolve pkexec binary (`/usr/bin/pkexec` or `which pkexec`)
|
|
2. If not present → IAMROOT_OK (no attack surface)
|
|
3. Run `pkexec --version` and parse version
|
|
4. Compare to known-fixed thresholds; report VULNERABLE if below
|
|
|
|
## Exploit logic (follow-up)
|
|
|
|
Canonical Qualys / public Pwnkit PoC:
|
|
|
|
1. Build a malicious shared object that `exit(setuid(0)); system("/bin/sh")`
|
|
2. Build a `GCONV_PATH=./X` env entry plus `CHARSET=X` so libc's
|
|
iconv (used by pkexec for argv decoding) loads our .so
|
|
3. `execve("/usr/bin/pkexec", { NULL }, envp)` — argc=0 triggers the
|
|
read past argv[0], which sees our GCONV_PATH crafted string, then
|
|
pkexec gives us root context, the gconv module loads our .so as
|
|
root, we drop to a shell
|
|
|
|
~200 lines including the embedded .so generator. Phase 7 follow-up
|
|
commit lands the full version.
|
|
|
|
## Detection rules (shipped)
|
|
|
|
`detect/auditd.rules` — flags pkexec invocations from non-root.
|
|
|
|
## References
|
|
|
|
- https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-4034
|