CVE-2021-4034

On Linux, normal user accounts are meant to stay “limited.” The polkit pkexec program is a special helper that temporarily allows a user to run certain actions with higher privileges. This flaw means a malicious user on the same machine can try to trick pkexec into giving them privileges they shouldn’t have—like bypassing a building’s security checkpoint by exploiting how the staff badge system is validated.

This matters to you if you use or run Linux systems that include the polkit pkexec utility on: Astra Linux Special Edition, Astra Linux Common Edition (from ООО «РусБИТех-Астра»), Debian GNU/Linux (Сообщество свободного программного обеспечения Debian GNU/Linux), Ubuntu (Canonical Ltd.), Fedora, CentOS, РЕД ОС (ООО «Ред Софт»), polkit (Сообщество свободного программного обеспечения Polkit), and “ФССП России ОС ТД АИС ФССП России” / “Эльбрус” variants listed in the CVE record. It also matters if your systems are part of Siemens environments like RUGGEDCOM and SCALANCE, since Siemens reported additional third‑party component issues that could contribute to risk there (per the provided technical description).

This is RED because attackers can already exploit it in the real world: it’s listed as Known exploited in the wild (CISA KEV) and there is a public exploit available, with a very high estimated exploitation likelihood. Even if you haven’t seen an incident, you should treat it as something to patch immediately, since a local foothold (like a compromised user account or malware already running) can turn into full system control.

1. Identify exposure

• Confirm which operating systems you run from the affected list (Astra Linux Special Edition/Common Edition, Debian GNU/Linux, Ubuntu, Fedora, CentOS, РЕД ОС, polkit packages, Astra Linux Special Edition for «Эльбрус», and “ФССП России ОС ТД АИС ФССП России”).
• On each affected host, inventory the polkit package version and confirm whether pkexec is present/enabled as shipped by your distro.

2. Patch

• Follow vendor guidance and update to the latest versions. Siemens has released updates for affected products and recommends updating to the latest versions (apply Siemens updates for RUGGEDCOM/SCALANCE environments if applicable).
• For general Linux hosts, update the polkit (pkexec) component via your distribution’s normal package update mechanism, and then reboot if your vendor instructs it.

3. Verify

• After updating, verify that the installed polkit/pkexec package version is no longer the vulnerable one (use your vendor’s security advisories for the exact fixed versions; the provided context does not list specific version numbers).
• Re-check that the updated packages were actually installed on every host (including servers, workstations, jump boxes, and any containers/VM templates if you treat them like standalone systems).

4. Monitor and harden while you patch (if you can’t update immediately)

• Look for signs of local compromise (unusual authentication events, suspicious processes launched from user sessions, unexpected privilege changes). The provided context does not give specific indicators, so use your environment’s usual monitoring.
• Reduce the chance of local attackers by limiting who has interactive access to those machines and by tightening access to accounts.

5. Confirm known exploited status handling

• Because this is listed in CISA KEV and a public exploit exists, prioritize patching over other work. Make the “update polkit/pkexec” task time-bound and repeatable across all affected hosts.

CVE-2021-4034 is a local privilege escalation issue affecting polkit’s pkexec utility. In practical terms, the risk is that a user who can run code locally (or otherwise reach the machine) may be able to elevate privileges and gain control of the system.

What’s known from the provided context:

• Severity: HIGH (CVSS 7.8).
• EPSS: 94.9% estimated probability of exploitation in the next 30 days.
• CISA KEV: yes (Known exploited in the wild).
• Public exploit available: yes.
• Exploitation status (from press): none (note: press says none, but KEV + public exploit indicate real-world risk).

Attack surface / weakness type (as described at a high level in the provided title/summary): improper handling in pkexec, which is a setuid tool used to run commands as privileged users.

Additional technical note from the provided description: it also mentions multiple third-party component vulnerabilities (Busybox applet, Linux Kernel, OpenSSL, OpenVPN, and other components) that could lead to code injection or denial of service, reported for Siemens products RUGGEDCOM and SCALANCE. The exact relationship between those component issues and pkexec in this CVE record is not fully specified in the provided context.

About EPSS and KEV (plain meaning):

• EPSS is an estimate of how likely exploitation is in a given timeframe.
• KEV means the flaw is confirmed as exploited in the wild by tracking/curation (so it’s treated as a priority by defenders).