PeterDonis said:It looks like both the Linux kernel and the pkexec maintainers have patches in the works:
https://lore.kernel.org/lkml/20220126043947.10058-1-ariadne@dereferenced.org/T/
https://lore.kernel.org/lkml/20220126043947.10058-1-ariadne@dereferenced.org/T/ said:Interestingly, Michael Kerrisk opened an issue about this in 2008,
but there was no consensus to support fixing this issue then.
Hopefully now that CVE-2021-4034 shows practical exploitative use
of this bug in a shellcode, we can reconsider.
You can "fix" it at least for the time being by removing the setuid bit from the pkexec executable.jim mcnamara said:WSL Ubuntu shows the problem.
The Pkexec exploit is a vulnerability found in the Linux desktop environment that allows attackers to gain root access on major Linux distributions. Root access gives attackers complete control over the system and allows them to execute commands and access sensitive information.
The Pkexec exploit works by exploiting a flaw in the PolicyKit component of the Linux desktop environment. This component is responsible for managing system privileges and authorizing users to perform administrative tasks. The vulnerability allows attackers to bypass the authorization process and gain root access without a password.
According to security researchers, the Pkexec exploit affects major Linux distributions such as Ubuntu, Fedora, Debian, and CentOS. However, other distributions may also be vulnerable if they use the PolicyKit component in their desktop environment.
To protect your system from the Pkexec exploit, you should update your Linux distribution to the latest version that includes a fix for the vulnerability. Additionally, you can also disable the PolicyKit component or limit its access to certain users to reduce the risk of exploitation.
If your system has been affected by the Pkexec exploit, it is important to take immediate action to mitigate the damage. This may include removing any unauthorized changes made by the attacker, updating your system to the latest version, and scanning for any other potential malware or vulnerabilities that may have been introduced.