CVE-2021-3560: Red Hat Polkit Incorrect Authorization Vulnerability Allows Privilege Escalation
What It Is — Polkit in Red Hat Enterprise Linux contains an incorrect authorization flaw that bypasses credential checks for D‑Bus requests, letting a local, unprivileged user obtain root‑level privileges.
Exploitability — Publicly disclosed with proof‑of‑concept code; CVSS v3.1 base score 7.8 (High). No known active exploit campaigns, but the vulnerability is trivial to weaponize on an unpatched host.
Affected Products — Red Hat Enterprise Linux 7, 8, and 9 (any distribution that ships the vulnerable Polkit package).
Why It Matters for Trust & Control Assurance
- Access‑control hygiene: The flaw demonstrates how a single authorization bypass can collapse the “least‑privilege” control objective, a core pillar of continuous control assurance.
- Patch‑management evidence: Demonstrating timely remediation (patch applied, version verified) provides defensible audit evidence that an organization meets due‑diligence expectations across frameworks.
- Defensible audit trail: Maintaining logs of the patch lifecycle and D‑Bus policy reviews creates a traceable record that auditors and enterprise buyers can inspect when evaluating trust.
Recommended Actions
- Identify exposure – Inventory all RHEL hosts and confirm the Polkit package version.
- Apply Red Hat advisory – Deploy the Red Hat security update (RHSA‑2021:xxxx) that fixes CVE‑2021‑3560.
- Validate D‑Bus policies – Review and tighten D‑Bus policy files to ensure only authorized services can request privileged actions.
- Capture remediation evidence – Record patch status and policy changes in a control‑monitoring repository to support audit readiness.
Source: CISA KEV – CVE‑2021‑3560