CVE-2021-4034

For customers who cannot update immediately and doesn't have Secure Boot feature enabled, the issue can be mitigated by executing the following steps:

1) Install required systemtap packages and dependencies as per - pointed by https://access.redhat.com/solutions/5441

2) Install polkit debug info:

    debuginfo-install polkit
    

3) Create the following systemtap script, and name it pkexec-block.stp:

    probe process("/usr/bin/pkexec").function("main")  {
        if (cmdline_arg(1) == "")
                        raise(9);
}

4) Load the systemtap module into the running kernel:

    stap -g -F -m stap_pkexec_block pkexec_block.stp
    

5) Ensure the module is loaded:

     lsmod | grep -i stap_pkexec_block
stap_pkexec_block     434176  0

6) Once polkit package was updated to the version containing the fix, the systemtap generated kernel module can be removed by running:

    rmmod stap_pkexec_block
    

This mitigation doesn't work for Secure Boot enabled system as SystemTap would require an external compiling server to be able to sign the generated kernel module
with a key enrolled into the Kernel's keyring.