Known Exploited Vulnerability
7.8
HIGH
CVE-2021-4034
Red Hat Polkit Out-of-Bounds Read and Write Vulner - [Actively Exploited]
Description

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

INFO

Published Date :

Jan. 28, 2022, 8:15 p.m.

Last Modified :

Nov. 5, 2024, 7:38 p.m.

Remotely Exploitable :

No

Impact Score :

5.9

Exploitability Score :

1.8
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.

Required Action :

Apply updates per vendor instructions.

Public PoC/Exploit Available at Github

CVE-2021-4034 has a 407 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2021-4034 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Redhat enterprise_linux
2 Redhat enterprise_linux_desktop
3 Redhat enterprise_linux_server
4 Redhat enterprise_linux_workstation
5 Redhat enterprise_linux_server_aus
6 Redhat enterprise_linux_server_eus
7 Redhat enterprise_linux_server_tus
8 Redhat enterprise_linux_eus
9 Redhat enterprise_linux_for_ibm_z_systems_eus
10 Redhat enterprise_linux_for_power_little_endian
11 Redhat enterprise_linux_for_power_little_endian_eus
12 Redhat enterprise_linux_server_update_services_for_sap_solutions
13 Redhat enterprise_linux_for_ibm_z_systems
14 Redhat enterprise_linux_for_power_big_endian
15 Redhat enterprise_linux_for_scientific_computing
16 Redhat enterprise_linux_server_update_services_for_sap_solutions
1 Suse linux_enterprise_server
2 Suse linux_enterprise_desktop
3 Suse manager_server
4 Suse linux_enterprise_workstation_extension
5 Suse manager_proxy
6 Suse enterprise_storage
7 Suse linux_enterprise_high_performance_computing
1 Starwindsoftware starwind_virtual_san
2 Starwindsoftware command_center
3 Starwindsoftware starwind_hyperconverged_appliance
1 Siemens scalance_lpe9403_firmware
2 Siemens sinumerik_edge
3 Siemens scalance_lpe9403
1 Oracle zfs_storage_appliance_kit
2 Oracle http_server
1 Canonical ubuntu_linux
1 Polkit_project polkit

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

None

Updated: 5 days, 21 hours ago
0 stars 2 fork 2 watcher
Born at : Nov. 17, 2024, 11:53 a.m. This repo has been linked 414 different CVEs too.

None

Updated: 3 weeks, 6 days ago
0 stars 0 fork 0 watcher
Born at : Oct. 26, 2024, 10:33 a.m. This repo has been linked 1 different CVEs too.

Need help finding what room to do next if grinding points?

Python

Updated: 1 month ago
0 stars 0 fork 0 watcher
Born at : Oct. 20, 2024, 4:57 a.m. This repo has been linked 15 different CVEs too.

This repository is designed to provide a comprehensive collection of study materials, notes, and resources for the Offensive Security Certified Professional (OSCP) exam. It covers all key topics from basic to advanced, helping aspiring penetration testers to prepare efficiently for the exam.

cybersecurity hacking oscp oscp-guide oscp-journey oscp-prep

Updated: 1 month, 2 weeks ago
1 stars 0 fork 0 watcher
Born at : Oct. 4, 2024, 4:43 p.m. This repo has been linked 75 different CVEs too.

None

Makefile C Shell

Updated: 1 month, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Oct. 4, 2024, 12:33 p.m. This repo has been linked 1 different CVEs too.

None

Python C Shell PHP PowerShell ASP.NET

Updated: 1 month, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Oct. 1, 2024, 2:21 p.m. This repo has been linked 66 different CVEs too.

A comprehensive tool for categorizing TryHackMe rooms, including details such as difficulty, room type, subscription status, and much more, to enhance user experience in cybersecurity training.

Updated: 1 month, 4 weeks ago
1 stars 0 fork 0 watcher
Born at : Sept. 22, 2024, 1:03 p.m. This repo has been linked 6 different CVEs too.

A central location for various cyber security and ethical hacking notes.

Updated: 2 months ago
0 stars 0 fork 0 watcher
Born at : Sept. 19, 2024, 3:57 a.m. This repo has been linked 2 different CVEs too.

None

C

Updated: 2 months ago
0 stars 0 fork 0 watcher
Born at : Sept. 16, 2024, 2:06 p.m. This repo has been linked 1 different CVEs too.

None

Updated: 2 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 27, 2024, 2:39 a.m. This repo has been linked 1 different CVEs too.

My Final report of GSoC 2024 ❤️

Updated: 2 months, 4 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 23, 2024, 3:58 p.m. This repo has been linked 1 different CVEs too.

None

Updated: 3 months ago
0 stars 0 fork 0 watcher
Born at : Aug. 22, 2024, 9:17 a.m. This repo has been linked 1 different CVEs too.

滲透筆記

Updated: 3 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : Aug. 11, 2024, 11:35 p.m. This repo has been linked 1 different CVEs too.

My stars. View raw for full list.

Updated: 2 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 8, 2024, 6:44 p.m. This repo has been linked 8 different CVEs too.

None

Updated: 3 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 8, 2024, 6:23 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2021-4034 vulnerability anywhere in the article.

  • AttackIQ
Response to CISA Advisory (AA24-317A): 2023 Top Routinely Exploited Vulnerabilities

On November 12, 2024, the U.S. Cybersecurity & Infrastructure Security Agency (CISA) released a Cybersecurity Advisory (CSA) providing details on the Common Vulnerabilities and Exposures (CVEs) routin ... Read more

Published Date: Nov 13, 2024 (1 week, 2 days ago)
  • security.nl
VS publiceert overzicht van meest misbruikte kwetsbaarheden in 2023

De Amerikaanse autoriteiten hebben samen met cyberagentschappen uit Australië, Canada, Nieuw-Zeeland en het Verenigd Koninkrijk een overzicht van de meest misbruikte kwetsbaarheden in 2023 opgesteld. ... Read more

Published Date: Nov 12, 2024 (1 week, 3 days ago)
  • Help Net Security
Linux systems targeted with stealthy “Perfctl” cryptomining malware

Thousands of Linux systems are likely infected with the highly elusive and persistent “perfctl” (or “perfcc“) cryptomining malware and many others still could be at risk of getting compromised, Aqua S ... Read more

Published Date: Oct 07, 2024 (1 month, 2 weeks ago)
  • BleepingComputer
Linux malware “perfctl” behind years-long cryptomining campaign

A Linux malware named "perfctl" has been targeting Linux servers and workstations for at least three years, remaining largely undetected through high levels of evasion and the use of rootkits. Accordi ... Read more

Published Date: Oct 03, 2024 (1 month, 2 weeks ago)
  • Kaspersky
Exploits and vulnerabilities in Q2 2024

Q2 2024 was eventful in terms of new interesting vulnerabilities and exploitation techniques for applications and operating systems. Attacks through vulnerable drivers have become prevalent as a gener ... Read more

Published Date: Aug 21, 2024 (3 months ago)

The following table lists the changes that have been made to the CVE-2021-4034 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Modified Analysis by [email protected]

    Nov. 05, 2024

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:a:starwindsoftware:command_center:1.0:update3_build5871:*:*:*:*:*:* *cpe:2.3:a:starwindsoftware:starwind_hyperconverged_appliance:-:*:*:*:*:*:*:* *cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build14338:*:*:*:*:*:* OR *cpe:2.3:a:starwindsoftware:command_center:1.0:update3_build5871:*:*:*:*:*:* *cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build14338:*:*:*:*:*:*
  • Modified Analysis by [email protected]

    Nov. 05, 2024

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:a:starwindsoftware:command_center:1.0:update3_build5871:*:*:*:*:*:* *cpe:2.3:a:starwindsoftware:starwind_hyperconverged_appliance:-:*:*:*:*:*:*:* *cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build14338:*:*:*:*:*:* OR *cpe:2.3:a:starwindsoftware:command_center:1.0:update3_build5871:*:*:*:*:*:* *cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build14338:*:*:*:*:*:*
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Nov. 04, 2024

    Action Type Old Value New Value
    Added CVSS V3.1 CISA-ADP AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Modified Analysis by [email protected]

    Jun. 28, 2024

    Action Type Old Value New Value
    Changed Reference Type https://bugzilla.redhat.com/show_bug.cgi?id=2025869 Issue Tracking, Patch, Vendor Advisory https://bugzilla.redhat.com/show_bug.cgi?id=2025869 Issue Tracking, Patch
    Changed Reference Type https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Patch, Third Party Advisory https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Patch
    Changed Reference Type https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
    Changed Reference Type https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/ No Types Assigned https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/ Exploit, Third Party Advisory
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Removed CWE Red Hat, Inc. CWE-125
  • CVE Modified by [email protected]

    Oct. 18, 2023

    Action Type Old Value New Value
    Added Reference https://www.secpod.com/blog/local-privilege-escalation-vulnerability-in-major-linux-distributions-cve-2021-4034/ [No Types Assigned]
  • Modified Analysis by [email protected]

    Sep. 11, 2023

    Action Type Old Value New Value
    Added CWE NIST CWE-125
    Changed CPE Configuration OR *cpe:2.3:a:polkit_project:polkit:*:*:*:*:*:*:*:* OR *cpe:2.3:a:polkit_project:polkit:*:*:*:*:*:*:*:* versions up to (excluding) 121
  • CVE Modified by [email protected]

    Feb. 13, 2023

    Action Type Old Value New Value
    Changed Description CVE-2021-4034 polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
    Removed CVSS V3.1 Red Hat, Inc. AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Removed Reference https://access.redhat.com/errata/RHSA-2022:0265 [No Types Assigned]
    Removed Reference https://access.redhat.com/errata/RHSA-2022:0266 [No Types Assigned]
    Removed Reference https://access.redhat.com/errata/RHSA-2022:0267 [No Types Assigned]
    Removed Reference https://access.redhat.com/errata/RHSA-2022:0268 [No Types Assigned]
    Removed Reference https://access.redhat.com/errata/RHSA-2022:0269 [No Types Assigned]
    Removed Reference https://access.redhat.com/errata/RHSA-2022:0270 [No Types Assigned]
    Removed Reference https://access.redhat.com/errata/RHSA-2022:0271 [No Types Assigned]
    Removed Reference https://access.redhat.com/errata/RHSA-2022:0272 [No Types Assigned]
    Removed Reference https://access.redhat.com/errata/RHSA-2022:0273 [No Types Assigned]
    Removed Reference https://access.redhat.com/errata/RHSA-2022:0274 [No Types Assigned]
    Removed Reference https://access.redhat.com/errata/RHSA-2022:0443 [No Types Assigned]
    Removed Reference https://access.redhat.com/errata/RHSA-2022:0540 [No Types Assigned]
    Removed Reference https://access.redhat.com/security/cve/CVE-2021-4034 [No Types Assigned]
    Added CWE Red Hat, Inc. CWE-125
    Added CWE Red Hat, Inc. CWE-787
  • CVE Modified by [email protected]

    Feb. 02, 2023

    Action Type Old Value New Value
    Changed Description A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. CVE-2021-4034 polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector
    Added CVSS V3.1 Red Hat, Inc. AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Added Reference https://access.redhat.com/errata/RHSA-2022:0268 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2022:0269 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2022:0266 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2022:0267 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2022:0443 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2022:0265 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2022:0540 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2022:0273 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2022:0274 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2022:0271 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2022:0272 [No Types Assigned]
    Added Reference https://access.redhat.com/errata/RHSA-2022:0270 [No Types Assigned]
    Added Reference https://access.redhat.com/security/cve/CVE-2021-4034 [No Types Assigned]
    Removed CWE Red Hat, Inc. CWE-125
    Removed CWE Red Hat, Inc. CWE-787
    Removed CWE Reason CWE-125 / More specific CWE option available
  • Modified Analysis by [email protected]

    Oct. 25, 2022

    Action Type Old Value New Value
    Changed Reference Type https://www.starwindsoftware.com/security/sw-20220818-0001/ No Types Assigned https://www.starwindsoftware.com/security/sw-20220818-0001/ Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:a:starwindsoftware:command_center:1.0:update3_build5871:*:*:*:*:*:* *cpe:2.3:a:starwindsoftware:starwind_hyperconverged_appliance:-:*:*:*:*:*:*:* *cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build14338:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Oct. 11, 2022

    Action Type Old Value New Value
    Added Reference https://www.starwindsoftware.com/security/sw-20220818-0001/ [No Types Assigned]
  • Modified Analysis by [email protected]

    Oct. 05, 2022

    Action Type Old Value New Value
    Changed Reference Type http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html Third Party Advisory http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html Third Party Advisory, VDB Entry
    Changed Reference Type https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf No Types Assigned https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf Third Party Advisory
    Changed Reference Type https://www.oracle.com/security-alerts/cpuapr2022.html No Types Assigned https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* *cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:siemens:sinumerik_edge:*:*:*:*:*:*:*:* versions up to (excluding) 3.3.0
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:scalance_lpe9403_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.0 OR cpe:2.3:h:siemens:scalance_lpe9403:-:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Jun. 14, 2022

    Action Type Old Value New Value
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf [No Types Assigned]
  • CVE Modified by [email protected]

    Apr. 20, 2022

    Action Type Old Value New Value
    Added Reference https://www.oracle.com/security-alerts/cpuapr2022.html [No Types Assigned]
  • Modified Analysis by [email protected]

    Apr. 18, 2022

    Action Type Old Value New Value
    Removed Evaluator Description Please note that the fix for polkit has been committed to master, but an official release has not been supplied by the maintainers at the time of analysis. This limits the ability of our staff to represent this product through CPE. We advise all users reach out to the organizations responsible for maintaining their package repository to ensure the appropriate version and/or patch of your packages are installed.
    Changed Reference Type http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html No Types Assigned http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry
    Changed Reference Type http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html No Types Assigned http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html Third Party Advisory
    Changed Reference Type https://www.suse.com/support/kb/doc/?id=000020564 No Types Assigned https://www.suse.com/support/kb/doc/?id=000020564 Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:a:suse:enterprise_storage:7.0:*:*:*:*:*:*:* *cpe:2.3:a:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:-:*:*:* *cpe:2.3:a:suse:manager_proxy:4.1:*:*:*:*:*:*:* *cpe:2.3:a:suse:manager_server:4.1:*:*:*:*:*:*:* *cpe:2.3:o:suse:linux_enterprise_desktop:15:sp2:*:*:*:*:*:* *cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:*:-:*:* *cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:*:sap:*:* *cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp5:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Apr. 14, 2022

    Action Type Old Value New Value
    Added Reference https://www.suse.com/support/kb/doc/?id=000020564 [No Types Assigned]
  • CVE Modified by [email protected]

    Mar. 04, 2022

    Action Type Old Value New Value
    Added Reference http://packetstormsecurity.com/files/166200/Polkit-pkexec-Privilege-Escalation.html [No Types Assigned]
  • CVE Modified by [email protected]

    Mar. 03, 2022

    Action Type Old Value New Value
    Added Reference http://packetstormsecurity.com/files/166196/Polkit-pkexec-Local-Privilege-Escalation.html [No Types Assigned]
    Added CWE Red Hat, Inc. CWE-125
    Added CWE Red Hat, Inc. CWE-787
  • Initial Analysis by [email protected]

    Jan. 31, 2022

    Action Type Old Value New Value
    Added Evaluator Description Please note that the fix for polkit has been committed to master, but an official release has not been supplied by the maintainers at the time of analysis. This limits the ability of our staff to represent this product through CPE. We advise all users reach out to the organizations responsible for maintaining their package repository to ensure the appropriate version and/or patch of your packages are installed.
    Added CVSS V2 NIST (AV:L/AC:L/Au:N/C:C/I:C/A:C)
    Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://access.redhat.com/security/vulnerabilities/RHSB-2022-001 No Types Assigned https://access.redhat.com/security/vulnerabilities/RHSB-2022-001 Mitigation, Vendor Advisory
    Changed Reference Type https://bugzilla.redhat.com/show_bug.cgi?id=2025869 No Types Assigned https://bugzilla.redhat.com/show_bug.cgi?id=2025869 Issue Tracking, Patch, Vendor Advisory
    Changed Reference Type https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 No Types Assigned https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683 Patch, Third Party Advisory
    Changed Reference Type https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt No Types Assigned https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt Exploit, Mitigation, Third Party Advisory
    Added CWE NIST CWE-787
    Added CPE Configuration OR *cpe:2.3:a:polkit_project:polkit:*:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:a:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:* *cpe:2.3:a:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_eus:8.4:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Jan. 28, 2022

    Action Type Old Value New Value
    Removed CWE Red Hat, Inc. CWE-125
    Removed CWE Red Hat, Inc. CWE-787
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-4034 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-4034 weaknesses.

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.13 }} 0.01%

score

0.49759

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability