PwnKit CVE-2021-4034 pkexec GCONV_PATH LPE with Chunked Delivery

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects attempts to exploit the PwnKit vulnerability (CVE-2021-4034) in Polkit's pkexec. The rule monitors for malicious command-line arguments involving GCONV_PATH environment manipulation, the execution of pkexec by non-root users, and the presence of associated PwnKit payload artifacts, such as base64-encoded strings or specific chunked files.