CVE-2021-3560 is an incorrect authorization vulnerability in Red Hat Polkit. CISA added it to the Known Exploited Vulnerabilities catalogue on 12 May 2023, which means attackers have used it in real attacks. Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.
What This Vulnerability Means in Practice
incorrect authorization in a system like Polkit means the platform can make a privilege decision on the wrong basis. In this case, the problem is not a missing login prompt, but a broken trust decision around credential checks for D-Bus requests, which can turn an ordinary local request into elevated access.
That matters because authorization flaws often sit at the boundary between a low-privilege session and administrative control. When that boundary fails, the attacker does not need to steal a password first, they only need a path that reaches the flawed decision point.
Why It Is Dangerous on Linux Systems
Polkit is part of the control layer that decides whether a user or process can perform privileged actions. A weakness in that layer can expose services, configuration changes, package operations, account management, or other administrative functions to abuse from a non-privileged context.
For defenders, the danger is amplified when the vulnerable component is widely present and the attack path is simple. A flaw in local authorization can become a reliable privilege-escalation step, especially when attackers already have some foothold on the host through phishing, a web app exploit, or a misconfigured service.
Read the relevant vendor advisory and the CVE Program and NIST National Vulnerability Database entries for authoritative record details and affected-product guidance.
Exposure, Detection, and Remediation Priorities
Exposure checking starts with asset inventory, package visibility, and confirming whether affected hosts are internet-exposed or reachable by untrusted users. Organisations should correlate vendor advisories, internal software inventories, and vulnerability management queues so they know where the issue exists and which systems can be reached by an attacker.
Detection should focus on suspicious privilege changes, unexpected administrative commands, unusual use of local management utilities, and signs that a low-privilege account was able to execute actions it should not have been able to request. Post-patch review should include checking for persistence, new accounts, altered sudo or policy settings, and any evidence that credentials or sessions were reused after the initial escalation.
Where patching is delayed, reduce exposure by limiting local access, tightening host monitoring, and constraining the attack surface around the affected service paths. The practical goal is to make the vulnerable decision point harder to reach and easier to spot while remediation is pending.
Use Vulnerability Management Guide to prioritise KEV-listed issues, verify exposure, and track remediation status against real exploit activity.
Identity and Privilege Impact After Exploitation
Because this vulnerability can lead to privilege escalation, the compromise review should treat the host as an identity event, not just a software bug. If an attacker gained elevated access, they may have captured session context, local credentials, API tokens, SSH material, or service account secrets present on the machine.
That means remediation is not complete when the package is patched. Organisations should assess which credentials, keys, sessions, and trusted relationships were reachable from the elevated context, then reset or revoke anything that could have been exposed during the compromise window.
Use IAM and IGA Basics to anchor the identity review, Authorisation Models Guide to understand the privilege decision that failed, and NHI Lifecycle Management Guide to manage any affected service accounts or machine identities.
Risk and Threat Considerations
This vulnerability is especially risky because it gives attackers a practical path from local access to administrative control. If an initial foothold already exists, a reliable authorization bypass can shorten the attack chain and make persistence, lateral movement, and post-exploitation tooling much easier.
Failure mechanism: The attacker abuses the broken credential check around D-Bus requests so the system approves an action that should have been denied, then uses the resulting privilege to alter the host state or access protected material.
Impact: A successful exploit can expose administrative functions, facilitate persistence, and increase the chance that credentials, sessions, or other sensitive identity material on the host are compromised.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential-check failures and post-exploit rotation concerns map to credential lifecycle control. |
| AC-6 — Least Privilege | Privilege escalation is the core failure mode, so least privilege directly constrains impact. | |
| SI-2 — Flaw Remediation | The term is a known exploited vulnerability, so flaw remediation directly governs exposure handling. | |
| Recommendation — Rotate exposed credentials and revoke any authenticator material reachable from the compromised host. Limit local administrative reach so a single host flaw cannot grant broad system authority. Track, patch, and verify remediation for the KEV-listed flaw across all affected assets. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes prioritised vulnerability management directly material to this CVE. |
| CIS-4 — Secure Configuration of Enterprise Assets and Software | Hardening host policy and reducing exposed paths directly reduces the blast radius of this flaw. | |
| CIS-5 — Account Management | Post-exploitation review often requires account and session review after privilege escalation. | |
| Recommendation — Prioritise and verify remediation of exploited vulnerabilities using asset scope and exposure context. Harden affected hosts and restrict unnecessary local access paths that could reach the vulnerable service. Review and revoke accounts or sessions that could have been abused after the escalation. | ||
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | This CVE is explicitly an authorization bypass enabling elevated privileges. |
| T1078 — Valid Accounts | Exploit fallout may include stolen sessions or credentials used after elevation. | |
| Recommendation — Map observed host activity to privilege-escalation tradecraft and hunt for follow-on actions. Search for abuse of valid local or service credentials after the initial compromise. | ||
Practitioner Guidance
What to watch for: Treat KEV-listed authorization flaws as active exposure until every reachable host is confirmed patched or otherwise contained. That means prioritising assets with interactive users, remote management paths, and any system where local compromise would immediately translate into elevated control.
Practitioner takeaway: For privilege-escalation CVEs, the real question is not just whether the package is updated, but whether any system was already used as a stepping stone before the fix landed.