A 12 year old bug has been discovered in the Linux pkexec utility which allows any unprivileged user to gain full root privileges on a vulnerable host.
The new report from security researchers at Qualys explains how the vulnerability can be exploited.
In summary the vulnerability, dubbed PwnKit, allows any unprivileged user to gain full root privileges on a vulnerable system using the default polkit configuration.
Default installations of popular flavours of Linux including Ubuntu, Debian, CentOS and Fedora are all vulnerable to this exploit.
Pkexec is a utility that allows users to issue commands with elevated privileges similar to the sudo utility, but offering finer grained control. Pkexec is part of the Linux Polkit (Policy Kit).
The bug in pkexec has been around since the utility was first introduced back in 2009
If you are not immediately able to patch this vulnerability, the pkexec utility can be disabled by removing the SUID-bit with this command:
# chmod 0755 /usr/bin/pkexec
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)