CVE-2021-4034: 
NixOS vulnerability analysis and mitigation

A local privilege escalation vulnerability (CVE-2021-4034) was discovered in polkit's pkexec utility, a SUID-root program installed by default on every major Linux distribution. The vulnerability, dubbed 'PwnKit', has existed since May 2009 (commit c8c3d83) and affects the pkexec application, which is designed to allow unprivileged users to run commands as privileged users according to predefined policies (Qualys, NVD).

The vulnerability stems from pkexec's incorrect handling of command-line arguments. When pkexec is executed without arguments, it fails to properly validate the argument count, leading to an out-of-bounds read and write condition. The issue occurs because pkexec assumes there will always be at least one argument, allowing an attacker to manipulate environment variables to execute arbitrary code with root privileges (Qualys). The vulnerability has a CVSS v3.1 base score of 7.8 (High) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability allows any unprivileged local user to gain full root privileges on affected systems. The vulnerability is particularly dangerous because it is exploitable instantly and reliably in an architecture-independent way, even if the polkit daemon itself is not running (Qualys).

The primary mitigation is to install the security updates provided by the respective Linux distributions. As a temporary workaround, systems administrators can remove the SUID-bit from pkexec using the command 'chmod 0755 /usr/bin/pkexec'. However, this workaround may break legitimate functionality that relies on pkexec (Red Hat, Qualys).

The vulnerability received significant attention due to its widespread impact and ease of exploitation. Major Linux distributions quickly released patches, and security researchers widely discussed the vulnerability's implications. Red Hat rated it as having 'Important' severity, while other vendors and security firms emphasized the critical nature of applying patches promptly (Red Hat).