CVE-2021-3560: Red Hat Polkit Incorrect Authorization Vulnerability
CVE-2021-3560 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2023-05-12
Polkit (formerly PolicyKit) contains a vulnerability where it can be tricked into bypassing credential checks for D-Bus requests. This allows an unprivileged local attacker to escalate privileges to root, potentially creating new administrator accounts.
Yes. CVE-2021-3560 is known to be exploited in the wild, first recorded on 12 May 2023. Treat it as urgent.
How severe is CVE-2021-3560?
Critical severity, with a CVSS score of 7.8, published 12 May 2023.
Which products and versions are affected?
Polkit Project Polkit up to (excluding) 0.119; Red Hat Enterprise Linux 7.0, 8.0; Red Hat OpenShift Container Platform 4.7; Red Hat Virtualization 4.0; and 2 more.
Is there a fix for CVE-2021-3560?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-3560 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2021-3560?
Check whether you run Red Hat Polkit. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
Polkit Project Polkit up to (excluding) 0.119
Red Hat Enterprise Linux 7.0, 8.0
Red Hat OpenShift Container Platform 4.7
Red Hat Virtualization 4.0
Canonical Ubuntu Linux 20.04
Debian Debian Linux 11.0
Timeline
2021-06-10: disclosed: Public disclosure of the vulnerability via GitHub blog.
2022-02-16: other: NVD Published Date.
2023-05-12: kev added: Added to CISA's Known Exploited Vulnerabilities Catalog.