Polkadots PrivEsc

25 / SECURITY RESEARCH / LINUX PRIVILEGE ESCALATION

A proof-of-concept Linux local privilege escalation for CVE-2021-3560: races polkit's D-Bus accounts service to plant a passworded, privileged user in under a second.

Client: Independent security research (CVE-2021-3560)

Tags: Security Research · Privilege Escalation · Linux · Polkit · D-Bus · Race Condition · Bash

Problem

CVE-2021-3560, disclosed by GitHub Security Lab in June 2021, let an unprivileged local user on RHEL 8, Fedora 21, Debian Bullseye, or Ubuntu 20.04 reach root through polkit's accounts service. The bug itself only proved a process could dodge authorization. No public tooling turned that into a working, repeatable root shell.

Our Solution

A one-command exploit that turns a disclosed authorization bug into a reliable root shell. Sends a CreateUser request to polkit's D-Bus org.freedesktop.Accounts interface and kills the requesting process mid-call, so the authorization check that should reject an unprivileged caller runs against a process that no longer exists. Polkit allows the call by default. The new account lands in the privileged group with an operator-supplied password hash, ready for an immediate su. Account name, username, password hash, and the race's retry count are all flags, not hardcoded values, so the same script runs unattended across every affected distribution.

Technical Details

D-Bus Race Trigger

A dbus-send call to CreateUser is issued and the calling process is torn down inside the same window polkit uses to re-check who is asking. Losing that race is silent, so the attempt loops (default 20 iterations) until the account exists.

Privileged Account Seed

The created account is placed directly in the group polkit already treats as authorized, with a SHA-512 password hash (openssl passwd -6) supplied on the command line, not generated by the script, so no secret is ever written to disk in plaintext.

Cross-Distribution Defaults

Verified against the four distributions GitHub's advisory named: RHEL 8, Fedora 21, Debian testing (Bullseye), and Ubuntu 20.04. Flags override the account, display name, password hash, and retry count; sane defaults mean the bare command alone is a working demo.

Disclosure Context

Published after Red Hat and polkit's upstream shipped the fix (polkit 0.119), as a working reference for defenders validating patch status rather than a race against an open 0-day.