CVE-2021-4115

MEDIUM

Published Feb 21, 20224y ago · Modified Jun 17, 20262w ago

5.5 CVSS 3.1

Medium

Published Feb 21, 2022 4y ago

Last Modified Jun 17, 2026 2w ago

Description

There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned

CVSS Details

Base Score

5.5

Exploitability

1.8

Impact

3.6

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 1

CWE-400 Uncontrolled Resource Consumption Resource Mgmt

Affected Products 8

Vendor	Product	Version	Range
polkit_project	polkit	0.117	any
redhat	enterprise_linux	8.0	any
fedoraproject	fedora	34	any
fedoraproject	fedora	35	any
canonical	ubuntu_linux	20.04	any
canonical	ubuntu_linux	21.10	any
debian	debian_linux	11.0	any
oracle	zfs_storage_appliance_kit	8.8	any

References 6

packetstormsecurity.com http://packetstormsecurity.com/files/172849/polkit-File-Descriptor-Exhaustion.html
access.redhat.com https://access.redhat.com/security/cve/cve-2021-4115

Third Party Advisory
gitlab.com https://gitlab.com/redhat/centos-stream/rpms/polkit/-/merge_requests/6/diffs?commit_id=bf900df04dc390d389e59aa10942b0f2b15c531e

PatchThird Party Advisory
gitlab.freedesktop.org https://gitlab.freedesktop.org/polkit/polkit/-/issues/141

ExploitIssue TrackingPatchThird Party Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGKWCBS6IDZYYDYM2WIWJM5BL7QQTWPF/
oracle.com https://www.oracle.com/security-alerts/cpujul2022.html

PatchThird Party Advisory

Remediation

gitlab.com https://gitlab.com/redhat/centos-stream/rpms/polkit/-/merge_requests/6/diffs?commit_id=bf900df04dc390d389e59aa10942b0f2b15c531e

PatchThird Party Advisory
gitlab.freedesktop.org https://gitlab.freedesktop.org/polkit/polkit/-/issues/141

ExploitIssue TrackingPatchThird Party Advisory
oracle.com https://www.oracle.com/security-alerts/cpujul2022.html

PatchThird Party Advisory