CVE-2021-4034 polkit privilege escalation

[Joe Slater]

pkexec can be used to gain root access by passing no arguments to it and crafting the environment.
Details of this exploit have not been made available.

A workaround is to clear the SUID bit for pkexec.

References - https://access.redhat.com/security/cve/CVE-2021-4034
             https://nvd.nist.gov/vuln/detail/CVE-2021-4034
             https://lists.centos.org/pipermail/centos-announce/2022-January/073552.html

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/828180

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/828180
Committed: https://opendev.org/starlingx/tools/commit/6d7ab17023dc57bf86e78bd3c98b0ba05e1040f6
Submitter: "Zuul (22348)"
Branch: master

commit 6d7ab17023dc57bf86e78bd3c98b0ba05e1040f6
Author: Joe Slater <email address hidden>
Date: Mon Feb 7 13:21:38 2022 -0500

    polkit: fix CVE-2021-4034 polkit privilege escalation

    pkexec always assumes there is at least one argument, which can be
    exploited by crafting the environment and calling it with no
    arguments. No specific exploit has been published.

    Update to polkit-0.112-26.el7_9.1.

    == testing ==
    We just want to see if pkexec stills works.
    build and install an iso, then

    $ sudo pkexec --user puppet id
    Password: # enter sysadmin password
    uid=52(puppet) gid=52(puppet) groups=52(puppet)
    $
    ====

    Closes-bug: 1960087
    Signed-off-by: Joe Slater <email address hidden>
    Change-Id: I267e29d90e75dc772e17f0b5866850b4bb5ac3d2