Mitigating CVE-2021-4034 (policykit pkexec) vulnerability on CentOS 6

CentOS 6 has been end of life since 30.11.2020 – do not use it.

Well, you’re still reading this, so you are using it.

Really really quick mitigation: remove SUID-bit from pkexec: chmod ug-s /usr/bin/pkexec

RedHat provides updates and mitigation steps for RHEL6 (extended support), RHEL7 and RHEL8 on their customer portal – https://access.redhat.com/security/cve/CVE-2021-4034

Based on their excellent documentation it is easy to build a mitigation for CentOS 6 also.

• Make sure you can still install packages (f.ex use CentOS Vault)

• Install systemtap & kernel-devel -packages

• Download and install polkit-debuginfo-0.96-11.el6_10.1.x86_64.rpm (or equivalent correct version) from CentOS debuginfo-mirror (f.ex http://mirror.facebook.net/centos-debuginfo/6/x86_64/)

• Create pkexec_block.stp with the following content

    probe process("/usr/bin/pkexec").function("main") {
        if (cmdline arg(1) == "")
                        raise(9);
}

• Compile and install module:

stap -g -F -m stap_pkexec_block pkexec_block.stp

• Verify with lsmod that stap_pkexec_block -kernel module is loaded.

• Make sure that module is loaded also after a reboot (copy to right place, run depmod -a & verify).