killchain-compendium/exploit/linux/pkexec/CVE_2021_4034.md

CVE-2021-4032

• Qualys put it in the open

• arthepsy's exploit

• Arg counting starts at 1 inside pkexec logic

• execve( "/usr/binpkexec", (char **){NULL}, env) puts NULL into argc[1]

• The value behind NULL can be overwritten, which is the first env param