Red Hat · Polkit
CVE-2021-3560
Red Hat Polkit Incorrect Authorization Vulnerability
What it is
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CISA: Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 2, 2023
- Added to the CISA list
- May 12, 2023
- Published
- February 16, 2022
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 24% in the top 2.2% of all known vulnerabilities
- Weakness
- CWE-863
- More details
- NVD · CVE.org · CISA
All references (4)
More exploited flaws from Red Hat
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jun 27, 2022 | Out-of-Bounds Read and Write | Polkit | High 7.8 | 95% |
| Aug 26, 2026 | Race Condition | Libuser | High 7.4 | 8.5% |
| Aug 26, 2026 | Privilege Escalation | Automatic Bug Reporting Tool | High 7.8 | 5.0% |
| Sep 28, 2023 | Expression Language Injection | JBoss RichFaces Framework | Critical 9.8 | 74% |
| May 25, 2022 | Authentication Bypass | JBoss | Low 3.7 | 74% |
| May 25, 2022 | Information Disclosure | JBoss | Medium 5.9 | 53% |
| Dec 10, 2021 | Linux JBoss Seam 2 Remote Code Execution | JBoss Seam 2 | High 8.8 | 83% |
| Dec 10, 2021 | Remote Code Execution | JBoss Application Server | Critical 9.8 | 91% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.