PwnKit vulnerability affects major Linux distributors

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here.

PwnKit is a local privilege escalation vulnerability discovered in polkit’s pkexec, an SUID-root program that is installed by default on every major Linux distribution.

This vulnerability can be easily exploited due to the following

All major Linux distributions include pkexec by default.
Since its beginning in May 2009, pkexec has been vulnerable.
This vulnerability can be exploited by any unprivileged local user to gain full root privileges.
Even though this vulnerability is technically a memory corruption, it can be exploited instantly, reliably, and in an architecture-independent manner.
It can be exploited even if the polkit daemon is not running.

This vulnerability is been widely exploited after researchers have disclosed PoC. The official patch for PwnKit can be downloaded from the link below. As all Linux distributions use pkexec and only a few have released patches for this vulnerability for their operating system(OS) and organizations can remove the SUID-bit from pkexec as temporary mitigation until official patches of all Linux distributors are released.