Vulnerability detail
Enriched intelligence for a single CVE
High
CVE-2021-3560
PUBLISHEDIt was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the...
- Vendor
- Linux
- Product
- polkit
- Published
- Feb 16, 2022
- EPSS
- —
Description
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:L/AC:L/Au:N/C:C/I:C/A:C
Exploitation status
Exploited in the wild
Recorded 2023-05-12 00:00:00 UTC · Source
SSVC decision points
- Exploitation
- active
- Automatable
- No
- Technical impact
- total
References
Known exploited vulnerability sources
Catalogues that list this CVE as a known exploited vulnerability.
| Source | Added |
|---|---|
| CISA | May 12, 2023 |
Scanner integrations
| Scanner | Reference | Detected |
|---|---|---|
| Metasploit | https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/polkit_dbus_auth_bypass.rb | Apr 28, 2025 |
Potential proof of concepts
These PoCs are unverified and could contain malware. Use at your own risk.
github · Created 2024-03-24 11:37:18 UTC · 2 stars
Part of my cybersecurity thesis consists in exploring and exploiting this vulnerability.
github · Created 2023-11-08 05:11:56 UTC · 2 stars
Exploitation of the CVE-2021-3560 polkit vulnerability
github · Created 2022-05-02 23:56:31 UTC · 8 stars
Exploit for CVE-2021-3560 (Polkit) - Local Privilege Escalation
github · Created 2022-04-30 05:53:45 UTC · 24 stars
PolicyKit CVE-2021-3560 Exploitation (Authentication Agent)
github · Created 2022-04-29 18:57:30 UTC · 116 stars
PolicyKit CVE-2021-3560 Exploit (Authentication Agent)
github · Created 2022-02-13 10:12:51 UTC · 5 stars
f4T1H's PoC script for CVE-2021-3560 Polkit D-Bus Privilege Escalation
github · Created 2022-02-02 17:08:24 UTC · 4 stars
Polkit Exploit (CVE-2021-3560), no download capabilty? Copy and paste it!
github · Created 2021-11-12 10:15:45 UTC · 0 stars
CVE-2021-3560 (Polkit - Local Privilege Escalation)
github · Created 2021-07-30 11:41:34 UTC · 10 stars
Polkit D-Bus Authentication Bypass Exploit
github · Created 2021-07-28 06:05:46 UTC · 2 stars
NYCY_homework_&_meeting
github · Created 2021-07-02 10:03:26 UTC · 2 stars
ubuntu new PrivEsc race condition vulnerability
github · Created 2021-06-29 20:47:16 UTC · 24 stars
github · Created 2021-06-14 20:08:20 UTC · 118 stars
github · Created 2021-06-12 05:22:35 UTC · 38 stars
a reliable C based exploit and writeup for CVE-2021-3560.
Timeline
-
CVE ID Reserved
-
CVE Published to Public
-
Added to KEVIntel
-
Detected by Metasploit