<story><title>Pwnkit: Local Privilege Escalation in polkit&apos;s pkexec</title><url>https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt</url></story><parent_chain></parent_chain><comment><author>josephcsible</author><text>Here&amp;#x27;s a shorter summary of the vulnerability:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    for (n = 1; n &amp;lt; (guint) argc; n++)
&lt;/code&gt;&lt;/pre&gt;
Usually, after that loop, n equals argc (or could be less than argc if the loop breaks or something). But if argc is 0, then n will equal 1 after. Later on, the program writes to argv[n]. If argc is 0, then argv[n] is argv[1], which is out-of-bounds, but happens to refer to the same place as envp[0] (at least on Linux). This lets the attacker set an arbitrary environment variable, after ld.so(8) already sanitized the environment. In particular, setting the GCONV_PATH environment variable (which is one that would have been removed during sanitization) will cause pkexec to load and execute code from a .so file in an attacker-controlled directory.</text></comment>
<story><title>Pwnkit: Local Privilege Escalation in polkit&apos;s pkexec</title><url>https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt</url></story><parent_chain></parent_chain><comment><author>Klasiaster</author><text>Setuid programs like pkexec or sudo are hard to get right… Here an example of using systemd-run (not setuid, and the wrapper script neither) for something similar like sudo (but it uses a systemd unit instead of a direct child process in the same process group):&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gist.github.com&amp;#x2F;pothos&amp;#x2F;73dd4f7694acc3b6bbed614438f6e2b1&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gist.github.com&amp;#x2F;pothos&amp;#x2F;73dd4f7694acc3b6bbed614438f6e...&lt;/a&gt;&lt;p&gt;Since polkit is used (but not the setuid pkexec, this was the point of this exercise) there is still one setuid binary invoked for the PAM check, though.</text></comment>