1. 修复的CVE

CVE-2021-4034

polkit是一个在类 Unix操作系统中控制系统范围权限的组件。通过定义和审核权限规则，实现不同优先级进程间的通讯。polkit 的 pkexec application存在安全漏洞，攻击者可利用该漏洞通过精心设计环境变量诱导pkexec执行任意代码。成功执行攻击后，如果目标计算机上没有权限的用户拥有管理权限，攻击可能会导致本地权限升级。

2. 受影响的系统及软件包

银河麒麟桌面操作系统V4 SP1

  银河麒麟桌面操作系统V4 SP2

  银河麒麟桌面操作系统V4 SP3

  银河麒麟桌面操作系统V4 SP4

arm64 架构：

gir1.2-polkit-1.0、libpolkit-agent-1-0、libpolkit-backend-1-0、libpolkit-gobject-1-0、policykit-1

x86_64 架构：

gir1.2-polkit-1.0、libpolkit-agent-1-0、libpolkit-backend-1-0、libpolkit-gobject-1-0、policykit-1

mips64el 架构：

gir1.2-polkit-1.0、libpolkit-agent-1-0、libpolkit-backend-1-0、libpolkit-gobject-1-0、policykit-1

银河麒麟服务器操作系统V4 SP1

  银河麒麟服务器操作系统V4 SP2

  银河麒麟服务器操作系统V4 SP3

  银河麒麟服务器操作系统V4 SP4

arm64 架构：

gir1.2-polkit-1.0、libpolkit-agent-1-0、libpolkit-backend-1-0、libpolkit-gobject-1-0、policykit-1

x86_64 架构：

gir1.2-polkit-1.0、libpolkit-agent-1-0、libpolkit-backend-1-0、libpolkit-gobject-1-0、policykit-1

mips64el 架构：

gir1.2-polkit-1.0、libpolkit-agent-1-0、libpolkit-backend-1-0、libpolkit-gobject-1-0、policykit-1

3. 软件包修复版本

银河麒麟桌面操作系统V4 SP1

银河麒麟桌面操作系统V4 SP2

银河麒麟桌面操作系统V4 SP3

银河麒麟桌面操作系统V4 SP4

gir1.2-polkit-1.0_0.105-14.1kord0.5+esm1

libpolkit-agent-1-0_0.105-14.1kord0.5+esm1

libpolkit-backend-1-0_0.105-14.1kord0.5+esm1

libpolkit-gobject-1-0_0.105-14.1kord0.5+esm1

policykit-1_0.105-14.1kord0.5+esm1

银河麒麟服务器操作系统V4 SP1、

银河麒麟服务器操作系统V4 SP2、

银河麒麟服务器操作系统V4 SP3、

银河麒麟服务器操作系统V4 SP4

gir1.2-polkit-1.0_0.105-14.1kord0.5+esm1

libpolkit-agent-1-0_0.105-14.1kord0.5+esm1

libpolkit-backend-1-0_0.105-14.1kord0.5+esm1

libpolkit-gobject-1-0_0.105-14.1kord0.5+esm1

policykit-1_0.105-14.1kord0.5+esm1

4. 临时缓解措施

方法一：修改 pkexec的权限:

$sudo chmod 0755 /usr/bin/pkexec

5. 修复方法

下载补丁包进行升级安装

通过补丁包下载地址下载补丁包，使用软件包升级命令根据受影响的软件包列表 升级相关的组件。

$sudo dpkg -i Packagelists

6. 补丁包下载地址

银河麒麟桌面操作系统V4

X86_64软件包下载地址

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/gir1.2-polkit-1.0_0.105-14.1kord0.5+esm1_amd64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-agent-1-0_0.105-14.1kord0.5+esm1_amd64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-backend-1-0_0.105-14.1kord0.5+esm1_amd64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-gobject-1-0_0.105-14.1kord0.5+esm1_amd64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/policykit-1_0.105-14.1kord0.5+esm1_amd64.deb

arm64软件包下载地址

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/gir1.2-polkit-1.0_0.105-14.1kord0.5+esm1_arm64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-agent-1-0_0.105-14.1kord0.5+esm1_arm64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-backend-1-0_0.105-14.1kord0.5+esm1_arm64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-gobject-1-0_0.105-14.1kord0.5+esm1_arm64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/policykit-1_0.105-14.1kord0.5+esm1_arm64.deb

mips64el软件包下载地址

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/gir1.2-polkit-1.0_0.105-14.1kord0.5+esm1_mips64el.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-agent-1-0_0.105-14.1kord0.5+esm1_mips64el.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-backend-1-0_0.105-14.1kord0.5+esm1_mips64el.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-gobject-1-0_0.105-14.1kord0.5+esm1_mips64el.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/policykit-1_0.105-14.1kord0.5+esm1_mips64el.deb

银河麒麟服务器操作系统V4

X86_64软件包下载地址

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/gir1.2-polkit-1.0_0.105-14.1kord0.5+esm1_amd64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-agent-1-0_0.105-14.1kord0.5+esm1_amd64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-backend-1-0_0.105-14.1kord0.5+esm1_amd64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-gobject-1-0_0.105-14.1kord0.5+esm1_amd64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/policykit-1_0.105-14.1kord0.5+esm1_amd64.deb

arm64软件包下载地址

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/gir1.2-polkit-1.0_0.105-14.1kord0.5+esm1_arm64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-agent-1-0_0.105-14.1kord0.5+esm1_arm64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-backend-1-0_0.105-14.1kord0.5+esm1_arm64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-gobject-1-0_0.105-14.1kord0.5+esm1_arm64.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/policykit-1_0.105-14.1kord0.5+esm1_arm64.deb

mips64el软件包下载地址

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/gir1.2-polkit-1.0_0.105-14.1kord0.5+esm1_mips64el.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-agent-1-0_0.105-14.1kord0.5+esm1_mips64el.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-backend-1-0_0.105-14.1kord0.5+esm1_mips64el.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/libpolkit-gobject-1-0_0.105-14.1kord0.5+esm1_mips64el.deb

http://archive.cyjm16888.com/kylin/KYLIN-ALL/pool/policykit-1/policykit-1_0.105-14.1kord0.5+esm1_mips64el.deb

注：其他相关依赖包请到相同目录下载

7. 修复验证

使用软件包查询命令，查看相关的软件包版本与修复版本一致则成功修复。

$sudo dpkg -l |grep Packagename