CVE:CVE-2021-4034
CNNVD:CNNVD-202201-2343
polkit是一个在类 Unix操作系统中控制系统范围权限的组件。通过定义和审核权限规则，实现不同优先级进程间的通讯。
polkit 的 pkexec application存在缓冲区错误漏洞，攻击者可利用该漏洞通过精心设计环境变量诱导pkexec执行任意代码。成功执行攻击后，如果目标计算机上没有权限的用户拥有管理权限，攻击可能会导致本地权限升级。
solution:Upgrade polkit_project polkit to a higher version than *; Upgrade redhat enterprise_linux_server_update_services_for_sap_solutions to a higher version than 7.6,7.7,8.1,8.2,8.4,and avoid the version 7.6,7.7,8.1,8.2,8.4; Upgrade redhat enterprise_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade redhat enterprise_linux_desktop to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_eus to a higher version than 8.2,and avoid the version 8.2; Upgrade redhat enterprise_linux_for_ibm_z_systems to a higher version than 7.0,8.0,and avoid the version 7.0,8.0; Upgrade redhat enterprise_linux_for_ibm_z_systems_eus to a higher version than 8.2,8.4,and avoid the version 8.2,8.4; Upgrade redhat enterprise_linux_for_power_big_endian to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_for_power_little_endian to a higher version than 7.0,8.0,and avoid the version 7.0,8.0; Upgrade redhat enterprise_linux_for_power_little_endian_eus to a higher version than 8.1,8.2,8.4,and avoid the version 8.1,8.2,8.4; Upgrade redhat enterprise_linux_for_scientific_computing to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_server to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_server_aus to a higher version than 7.3,7.4,7.6,7.7,8.2,8.4,and avoid the version 7.3,7.4,7.6,7.7,8.2,8.4; Upgrade redhat enterprise_linux_server_eus to a higher version than 8.4,and avoid the version 8.4; Upgrade redhat enterprise_linux_server_tus to a higher version than 7.6,7.7,8.2,8.4,and avoid the version 7.6,7.7,8.2,8.4; Upgrade redhat enterprise_linux_workstation to a higher version than 7.0,and avoid the version 7.0; Upgrade canonical ubuntu_linux to a higher version than 14.04,16.04,18.04,20.04,21.10,and avoid the version 14.04,16.04,18.04,20.04,21.10; Upgrade suse enterprise_storage to a higher version than 7.0,and avoid the version 7.0; Upgrade suse linux_enterprise_high_performance_computing to a higher version than 15.0:sp2,and avoid the version 15.0:sp2; Upgrade suse manager_proxy to a higher version than 4.1,and avoid the version 4.1; Upgrade suse manager_server to a higher version than 4.1,and avoid the version 4.1; Upgrade suse linux_enterprise_desktop to a higher version than 15:sp2,and avoid the version 15:sp2; Upgrade suse linux_enterprise_server to a higher version than 15:sp2,and avoid the version 15:sp2; Upgrade suse linux_enterprise_workstation_extension to a higher version than 12:sp5,and avoid the version 12:sp5; Upgrade oracle http_server to a higher version than 12.2.1.3.0,12.2.1.4.0,and avoid the version 12.2.1.3.0,12.2.1.4.0; Upgrade oracle zfs_storage_appliance_kit to a higher version than 8.8,and avoid the version 8.8; Upgrade siemens sinumerik_edge to a higher version than 3.3.0,and avoid the version (,3.3.0); Upgrade siemens scalance_lpe9403_firmware to a higher version than 2.0,and avoid the version (,2.0); Upgrade starwindsoftware command_center to a higher version than 1.0:update3_build5871,and avoid the version 1.0:update3_build5871; Upgrade starwindsoftware starwind_hyperconverged_appliance to a higher version than -; Upgrade starwindsoftware starwind_virtual_san to a higher version than v8:build14338,and avoid the version v8:build14338