Incorrect authorization in polkit
Priority CRITICAL 93Exploited in the wildCWE-863Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-863.
Summary
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Why it matters now
Exploitation Active In CISA KEV since 2023-05-12CISA due date 2023-06-02
EPSS 0.22193 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 5 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | polkit | polkit 0.119 | — | No fix listed | CNA |
- polkit Vendor— Affected polkit 0.119 Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:polkit_project:polkit:*:*:*:*:*:*:*:* | before 0.119 | Vulnerable | Polkit Project |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:*:*:*:* | 20.04 | Vulnerable | Canonical |
| cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Running on | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.7:*:*:*:*:*:*:* | 4.7 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
- cpe:2.3:a:polkit_project:polkit:*:*:*:*:*:*:*:* Versions before 0.119 Vulnerable ·Polkit Project
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:*:*:*:* Versions 20.04 Vulnerable ·Canonical
- cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
Remediation
Red Hat 5 advisories
- RHSA-2021:2555 Released 2021-07-06 · Red Hat rating ImportantOpenShift Container Platform 4.7.19 packages and security update
- Red Hat OpenShift Container Platform 4.7 cri-o-1.20.3-6.rhaos4.7.git0d0f863.el7, cri-o-1.20.3-6.rhaos4.7.git0d0f863.el8, dhcp-12:4.3.6-41.el8_3.1 +14
- RHSA-2021:2522 Released 2021-06-22 · Red Hat rating ImportantRed Hat Virtualization Host security update [ovirt-4.4.6]
- Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.4.6-20210615.0.el8_4, redhat-virtualization-host-image-update-4.4.6-20210615.0.el8_4
- RHSA-2021:2238 Released 2021-06-03 · Red Hat rating Importantpolkit security update
- Red Hat Enterprise Linux BaseOS (v. 8) polkit-0.115-11.el8_4.1, polkit-devel-0.115-11.el8_4.1, polkit-docs-0.115-11.el8_4.1 +1
Show 2 more Red Hat advisories
- RHSA-2021:2237 Released 2021-06-03 · Red Hat rating Importantpolkit security update
- Red Hat Enterprise Linux BaseOS EUS (v. 8.2) polkit-0.115-11.el8_2.1, polkit-devel-0.115-11.el8_2.1, polkit-docs-0.115-11.el8_2.1 +1
- RHSA-2021:2236 Released 2021-06-03 · Red Hat rating Importantpolkit security update
- Red Hat Enterprise Linux BaseOS EUS (v. 8.1) polkit-0.115-9.el8_1.1, polkit-devel-0.115-9.el8_1.1, polkit-docs-0.115-9.el8_1.1 +1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2021:2238 |
| Red Hat Enterprise Linux BaseOS EUS (v. 8.1) | Fixed | RHSA-2021:2236 |
| Red Hat Enterprise Linux BaseOS EUS (v. 8.2) | Fixed | RHSA-2021:2237 |
| Red Hat OpenShift Container Platform 4.7 | Fixed | RHSA-2021:2555 |
| Red Hat Virtualization 4 Hypervisor for RHEL 8 | Fixed | RHSA-2021:2522 |
Not affected: 4 products
- RHEL 8-based RHEV-H for RHEV 4 (build requirements)
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 9
Timeline
- 2023-05-12 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2021-3560
- 2026-10-03 Alias added: GHSA-7c49-j253-wq5r
References
More Red Hat Openshift Container Platform vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-34021 Linux kernel skb coalescing drops shared-frag marker KEVCVSS 3.1HIGH 7.8
- TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2021-3560 · CVE Program
- CVE-2021-3560 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-7c49-j253-wq5r · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3560 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences