CVE-2021-4034: PwnKit Polkit Vulnerability Explained — Root Access on Every Linux System for 12 Years

pkexec is a SUID-root binary that processes its command-line arguments (argc/argv) to determine which program to execute with elevated privileges. The vulnerability is in how pkexec handles the case where argc is 0 or argv is effectively empty. When a process is invoked with an empty argv array, pkexec reads argv[1] — which is out of bounds. The memory adjacent to argv[] in a process's memory layout is envp[] (the environment variable array). So pkexec reads from envp[] as if it were argv[].

Through carefully crafted environment variable layout, the attacker causes pkexec to write an unsanitized path value from the out-of-bounds argv[1] read back into envp[] — effectively inserting an attacker-controlled environment variable. The inserted variable is GCONV_PATH=., which overrides the system gconv library search path. pkexec, still running as SUID root, subsequently calls a locale function that loads a gconv shared library from the current directory — where the attacker has placed a malicious library. The library executes arbitrary code as root.

The vulnerable code was present from polkit's initial public release in 2009. Every distribution-shipped version of pkexec across 12 years was affected. Qualys noted that similar vulnerable patterns exist in other SUID binaries that perform the same argc=0 handling — making PwnKit potentially a vulnerability class rather than an isolated flaw.

The detection challenge is significant. Standard authentication logging in /var/log/auth.log and syslog captures nothing from the exploit path — the vulnerable code runs before pkexec's authentication and audit logic. Detection requires either: auditd rules monitoring the specific execve() and open() syscall patterns used by the exploit, EDR solutions performing memory behavior analysis, or filesystem monitoring alerting on writes to directories named GCONV_PATH=. or the presence of attacker staging files in /tmp/ and /dev/shm/.

All major distributions released patched polkit packages on January 25–26, 2022, the same day Qualys published the advisory. Apply the update immediately.

PwnKit illustrates a category of vulnerability that is particularly damaging: a flaw in a universally deployed security component that has been present for over a decade, is trivially exploitable by any local user, and leaves no conventional log traces. The polkit framework exists to mediate privilege — a vulnerability allowing privilege bypass in the privilege mediator itself represents a fundamental failure of the security model.

For defenders: patching is the only complete mitigation. The absence of auth.log entries means you cannot rely on conventional SIEM alerting to detect exploitation. Organizations that have not patched should assume that any threat actor with any local foothold on any Linux host has already evaluated this path to root.