Qualys has discovered a vulnerability (CVE-2021-4034) in the system component Polkit (formerly known as PolicyKit), used in distributions to facilitate actions by unprivileged users that require elevated permissions. This vulnerability allows a local unprivileged user to escalate their privileges to that of the root user and gain full control over the system. The issue has been dubbed PwnKit and is notable for the availability of a working exploit that operates in the default configuration of most Linux distributions.
The issue exists in the PolKit utility pkexec, which is shipped with the SUID root flag and is intended for executing commands with the privileges of another user according to the rules defined by PolKit. Due to improper handling of command line arguments passed to pkexec, an unprivileged user could bypass authentication and achieve execution of their code with root privileges, regardless of the access rules set. The specific settings and limitations in PolKit do not matter; it is sufficient for the executable file of the pkexec utility to have the SUID root flag set.
Pkexec does not validate the argument count (argc) passed when launching the process. The developers of pkexec assumed that the first entry of the argv array always contained the process name (pkexec), and the second would either be NULL or the name of the command being executed via pkexec. Since the argument count was not checked against the actual content of the array and it was assumed to always be greater than 1, when an empty argv array was passed to the process, which is permitted by the execve function in Linux, pkexec interpreted the NULL as the first argument (process name) and the subsequent memory outside the buffer as the next contents of the array.
The issue is that immediately following the argv array in memory is the envp array, which contains environment variables. Thus, with an empty argv array, pkexec extracts data about the command being run with elevated privileges from the first element of the environment variable array (argv[1] becomes identical to envp[0]), the contents of which can be controlled by an attacker.
Upon obtaining the value of argv[1], pkexec attempts to resolve the full path to the executable file based on the file paths in PATH and writes a pointer to the string with the full path back into argv[1], which leads to overwriting the value of the first environment variable, as argv[1] is identical to envp[0]. By manipulating the name of the first environment variable, an attacker can substitute another environment variable in pkexec, for example, substituting the "LD_PRELOAD" environment variable, which is not allowed in suid programs, thereby causing their own shared library to be loaded into the process.
The operational exploit involves substituting the GCONV_PATH variable, which is used to determine the path to the character encoding conversion library, dynamically loaded upon calling the g_printerr() function, which uses iconv_open(). By overriding the path in GCONV_PATH, the attacker can achieve the loading of their own iconv library instead of the standard one, with handlers from which will be executed during error message output at a stage when pkexec is still running with root privileges and before the authority checks are performed.
It is noted that, despite the issue being caused by memory corruption, it can be reliably and repeatedly exploited regardless of the hardware architecture used. The prepared exploit has been successfully tested on Ubuntu, Debian, Fedora, and CentOS but can also be used on other distributions. The original exploit is not yet publicly available, indicating that it is trivial and can easily be recreated by other researchers. Therefore, it is crucial to install the patch update as soon as possible on multi-user systems. Polkit is also available for BSD systems and Solaris, but no research has been conducted on the feasibility of exploitation in those environments. It is only known that the attack cannot be executed in OpenBSD, as the OpenBSD kernel does not allow the transmission of a null argc value during execve().
The issue has been present since May 2009, when the pkexec command was added. The vulnerability fix in Polkit is currently available as a patch (no corrective release has been generated), but since the developers of the distributions were pre-informed about the problem, most distributions published an update simultaneously with the disclosure of the vulnerability. The problem has been resolved in RHEL 6/7/8, Debian, Ubuntu, openSUSE, SUSE, Fedora, ALT Linux, ROSA, Gentoo, Void Linux, Arch Linux, and Manjaro. As a temporary measure to block the vulnerability, the SUID root flag can be removed from the program /usr/bin/pkexec (‘chmod 0755 /usr/bin/pkexec’).
Source: opennet.ru
