Privilege Escalation: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)

This document describes a threat finding type in Security Command Center. Threat findings are generated by threat detectors when they detect a potential threat in your cloud resources. For a full list of available threat findings, see Threat findings index.

Overview

Polkit's pkexec has been executed with the GCONV_PATH environment variable set. A local user can use this flaw to gain root privileges on a compromised system to run specially crafted code.

Cloud Run Threat Detection is the source of this finding.

How to respond

To respond to this finding, do the following:

Review finding details

  1. Open the Privilege Escalation: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) finding as directed in Reviewing findings. Review the details on the Summary and JSON tabs.

  2. On the Summary tab, review the information in the following sections.

    • What was detected, especially the following fields:
      • Program binary: the absolute path of the executed binary
      • Arguments: the arguments passed during binary execution
    • Affected resource, especially the following fields:

  3. On the JSON tab, note the following fields.

    • resource:
      • project_display_name: the name of the project that contains the affected Cloud Run resource
    • finding:
      • processes:
        • binary:
        • path: the full path of the executed binary
      • args: the arguments that were provided when the binary was executed

  4. Identify other findings that occurred at a similar time for the affected container. Related findings might indicate that this activity was malicious, instead of a failure to follow best practices.

  5. Review the settings of the affected container.

  6. Check the logs for the affected container.

Research attack and response methods

  1. Review MITRE ATT&CK framework entries for this finding type: Privilege Escalation.
  2. To develop a response plan, combine your investigation results with MITRE research.

Implement your response

For response recommendations, see Respond to Cloud Run threat findings.

What's next