Last night, security firm Qualys released information about a critical vulnerability in all major Linux distributions.
The vulnerability is due to a bug in the “Polkit” program and is labeled CVE-2021-4034. Polkit is a program that allows unauthorized processes to communicate with authorized processes.
By exploiting the bug, a local user can easily gain root privileges on a system, but only if they already have some unprivileged (user) access via SSH or your webserver. This however can also happen if you have a basic vulnerability in one of your websites (WordPress for example). In that case, a malware infection on that one website, could lead to the entire server being hacked.
For security reasons we recommend updating your server as soon as possible. For Code Orange Managed servers, we have done this for you directly after this information was disclosed.
Use this command to disable the risk directly:
chmod 0755 /usr/bin/pkexec
Then run the following to update your packages:
Ubuntu/Debian: sudo apt -y update && sudo apt -y upgrade
CentOS/AlmaLinux: sudo yum -y update