602-725-2818Licensed, insured & bondedSchedule a Consultation
Call 602-725-2818Consultation
sales@honeybadgersolution.com
sales@honeybadgersolution.com Cart

Linux Privilege Escalation: From Foothold to Root, and the Bugs That Get There

/ Cybersecurity & Threat Intelligence / By

A modern intrusion rarely begins with the crown jewels. It begins with a toehold: a reused password, a vulnerable web application, a phished SSH key, a misconfigured service running as an unprivileged account. On a Linux host, that initial access lands the threat actor in a low-privileged shell, boxed inside the permissions of whatever account they compromised. From there, the entire trajectory of the breach depends on a single question: can the attacker turn that limited foothold into full control of the machine?

That transition is called privilege escalation, and on Linux the prize is root — the superuser account that owns the kernel, every process, every file, and every secret on the box. Once an attacker holds root, they can disable logging, install persistent backdoors, dump credentials, pivot to neighboring systems, and erase the forensic trail that would otherwise expose them. Understanding how that escalation happens — and how a well-run security program cuts it off — is one of the most valuable defensive skills in the Linux world.

This article walks through how attackers move from foothold to root, the difference between kernel and userland escalation paths, and four of the most infamous local privilege escalation vulnerabilities of the past several years. Every CVE below has been verified against the National Vulnerability Database and confirmed present in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) Catalog. The goal is entirely defensive and educational: no exploit code, no working steps — only the concepts you need to prioritize patching and harden your environment.

What “Privilege Escalation” Actually Means on Linux

Linux enforces a hard boundary between ordinary users and the superuser. A normal account can read its own files, run permitted programs, and generally cannot touch anything that would compromise the system as a whole. Root, by contrast, is effectively unlimited. Local privilege escalation (often abbreviated LPE) is the act of crossing that boundary from below — a user who is already present on the system abusing a vulnerability or misconfiguration to gain privileges they were never granted.

It is worth separating two related but distinct ideas. Remote code execution gets an attacker onto a machine in the first place. Privilege escalation is what happens next, once they are already inside. The two are frequently chained: a threat actor exploits a public-facing service to land as the low-privileged www-data account, then reaches for a local escalation bug to become root. This is why a vulnerability that “only” requires local access is still treated as critical. In a real intrusion, “local” is not a barrier — it is simply the second step, and attackers assume they will already be inside when they use it.

Kernel vs. Userland: Two Roads to Root

Privilege escalation bugs on Linux fall into two broad families, and the distinction matters for both attackers and defenders.

The kernel path

The Linux kernel is the single most privileged piece of software on the machine. It runs in a protected space, mediates every system call, and enforces the permission model itself. A memory-corruption or logic flaw in the kernel is therefore devastating: if an unprivileged process can manipulate kernel memory or confuse a privileged code path, it may be able to rewrite its own permissions or execute code at the highest level. Kernel escalation bugs tend to be powerful and broadly applicable, but they can be sensitive to specific kernel versions, and they are the reason kernel patching and reboots are non-negotiable maintenance items.

The userland path

Not every road to root runs through the kernel. Linux ships with a collection of trusted user-space programs that are intentionally allowed to run with elevated privileges so that ordinary users can perform controlled administrative tasks — changing a password, mounting a device, or running a specific command as another user. These are marked with the SUID (Set User ID) bit or governed by helpers like sudo and polkit. Because these programs deliberately straddle the privilege boundary, a bug in one of them hands an attacker elevation without ever touching the kernel. Userland escalation flaws are often more portable across distributions and kernel versions, which is exactly what makes them so attractive to threat actors and so dangerous when left unpatched.

Both families share a common lesson: the more code that runs with elevated privilege, the larger the attack surface an intruder can probe. Keep that idea in mind — it drives every defense discussed later.

Four Infamous Linux Privilege-Escalation Bugs

The following vulnerabilities are among the most widely discussed local privilege escalation flaws of recent years. Each is real, each was exploited or trivially exploitable in the wild, and each appears in CISA’s KEV Catalog — the federal government’s authoritative list of vulnerabilities confirmed to be actively exploited. They are described here at a conceptual level only.

PwnKit — CVE-2021-4034 (polkit’s pkexec)

polkit (formerly PolicyKit) is a userland framework that lets unprivileged processes request specific privileged actions. Its pkexec helper is installed by default on many major Linux distributions and carries the SUID bit, allowing it to run as root. CVE-2021-4034, nicknamed PwnKit and disclosed by the Qualys Research Team in January 2022, is a memory-corruption vulnerability rooted in how pkexec mishandled its command-line arguments and environment variables. NVD classifies it as an out-of-bounds read and write (CWE-125 and CWE-787), carrying a CVSS 3.1 base score of 7.8 (High).

What made PwnKit so alarming was its reach. Because pkexec shipped by default and had done so for more than a decade, an enormous population of systems was affected the moment the flaw was published. Any unprivileged local user could leverage the bug to obtain full root privileges, and it required no unusual conditions to trigger. CISA added CVE-2021-4034 to the KEV Catalog on June 27, 2022. PwnKit is the archetypal userland escalation: no kernel exploit needed, wildly portable, and enabled entirely by a trusted SUID program that was allowed to do too much with too little scrutiny.

Dirty Pipe — CVE-2022-0847 (Linux kernel)

Dirty Pipe, disclosed by Max Kellermann in March 2022, is a kernel vulnerability and a textbook example of the kernel escalation path. NVD attributes CVE-2022-0847 to the Linux kernel and categorizes it as improper initialization (CWE-665): a flag member in a newly created pipe buffer structure was not properly initialized and could retain stale values. The consequence, as NVD describes it, is that an unprivileged local user could write into pages backing read-only files and thereby escalate privileges. Its CVSS 3.1 base score is also 7.8 (High).

The name is a nod to the earlier “Dirty COW” kernel bug, and the comparison is apt: both let an attacker corrupt data they should only be able to read. In practice, the ability to modify a read-only file that the system trusts is a direct route to root, because so many privileged behaviors on Linux hinge on the integrity of files an ordinary user cannot normally alter. Dirty Pipe affected kernels from version 5.8 onward until it was patched. CISA added CVE-2022-0847 to the KEV Catalog on April 25, 2022, listing it as a Linux Kernel Privilege Escalation Vulnerability — a reminder that keeping the kernel current is a security control, not merely a performance one.

Looney Tunables — CVE-2023-4911 (glibc dynamic loader)

Looney Tunables, another Qualys discovery, was disclosed in October 2023 and lives in a place few defenders think about: the GNU C Library (glibc), specifically its dynamic loader, ld.so. NVD identifies CVE-2023-4911 as a buffer overflow (out-of-bounds write, CWE-787, and heap-based buffer overflow, CWE-122) triggered while the loader processed the GLIBC_TUNABLES environment variable. Its CVSS 3.1 base score is 7.8 (High).

The dynamic loader is the component that prepares a program to run, and it executes with the privileges of whatever it is launching — including SUID-root binaries. By supplying a crafted GLIBC_TUNABLES value when starting such a program, a local attacker could overflow a buffer in the loader and gain code execution as root. Because glibc is foundational to nearly every Linux distribution, the affected population was, once again, enormous — default installations of several mainstream distributions were vulnerable out of the box. CISA added CVE-2023-4911 to the KEV Catalog on November 21, 2023. Looney Tunables illustrates a subtle truth about attack surface: the escalation did not require a flaw in a dedicated privileged tool at all. It rode in through a shared library that every privileged program depends on.

Baron Samedit — CVE-2021-3156 (sudo)

Few programs are more trusted on a Linux system than sudo, the standard mechanism for running commands as another user, typically root. That trust is exactly what made Baron Samedit so serious. Disclosed by Qualys in January 2021, CVE-2021-3156 is a heap-based buffer overflow (stemming from an off-by-one error, CWE-193) in sudo’s handling of command-line arguments in its sudoedit path. NVD rates it 7.8 (High) on CVSS 3.1 and notes it affects sudo versions prior to 1.9.5p2.

The bug had lurked in the codebase for roughly a decade, meaning a vast range of sudo versions across virtually every Linux and Unix-like distribution was affected. A local user did not need any sudo permissions of their own to exploit it — the flaw could be triggered by any user, granting a path to full root access. CISA added CVE-2021-3156 to the KEV Catalog on April 6, 2022, and reissued warnings about active exploitation of sudo flaws in the years since. Baron Samedit is a reminder that the tools we rely on to enforce privilege boundaries are themselves attack surface, and they must be patched with the same urgency as anything else.

Why the KEV Catalog Matters

All four vulnerabilities above share one property beyond their severity scores: CISA has confirmed each is exploited in the real world and placed it in the Known Exploited Vulnerabilities Catalog. That distinction is the single most useful prioritization signal a defender has. There are hundreds of thousands of published CVEs, and no team can patch everything at once. The KEV Catalog cuts through the noise by answering the only question that truly changes your risk: is this being used against real organizations right now?

Under CISA Binding Operational Directive 22-01, federal civilian agencies are required to remediate KEV-listed vulnerabilities within set deadlines, and CISA strongly recommends every organization — public or private — treat the catalog as a core input to its vulnerability management program. If a Linux privilege escalation bug appears in KEV, it should jump to the front of your patch queue regardless of its CVSS score, because the exploitation risk is no longer theoretical.

Reducing Privilege-Escalation Risk

You cannot prevent every foothold, but you can make the leap from foothold to root far harder — and far noisier — than an attacker expects. A layered program does exactly that.

Patch rapidly, and prioritize with intelligence

Every vulnerability above was fixed by vendors, often within days of disclosure. The organizations that got breached were the ones that had not applied those patches. Build a vulnerability management process that ingests the CISA KEV Catalog, cross-references it against your Linux inventory, and drives emergency patching for anything on the list. Remember that kernel and glibc updates frequently require a reboot to take effect — a patch downloaded but not activated is not a patch at all. Track remediation to completion, not just to deployment.

Enforce least privilege everywhere

Privilege escalation only matters because there is somewhere higher to escalate to. The tighter your baseline privileges, the less an initial compromise is worth. Run services under dedicated, unprivileged accounts. Grant sudo rights narrowly and specifically rather than handing out blanket administrative access. Segment duties so that no single compromised account is a straight line to the entire environment. Least privilege does not stop an escalation bug, but it shrinks the blast radius of the foothold that would otherwise feed it.

Minimize the SUID/SGID attack surface

PwnKit, Looney Tunables, and Baron Samedit all abused programs that were allowed to run with elevated privilege. Inventory the SUID and SGID binaries on your Linux hosts and remove or restrict any that are not genuinely required. Every such program is a standing invitation for a userland escalation, so the smaller that set, the fewer doors an intruder can try. Treat the list of privileged helpers on a system as a security asset to be curated, not a default to be ignored.

Monitor for escalation behavior

Assume some attacker will eventually get a foothold, and instrument your systems to catch the next move. Endpoint detection and response (EDR) tooling, Linux audit logging (auditd), and behavioral monitoring can surface the telltale signs of escalation: unexpected execution of privileged helpers, anomalous use of sudo or pkexec, unusual child processes spawned by service accounts, or tampering with kernel modules. Forward those logs off-host so a threat actor who does reach root cannot quietly erase them. Detection buys you the chance to respond before a foothold becomes a full-scale compromise.

Harden containers and shared hosts

Multi-tenant and containerized Linux environments deserve special attention, because a single privilege escalation can breach the boundary between workloads. Run containers as non-root users, drop unnecessary Linux capabilities, apply seccomp and mandatory-access-control profiles (AppArmor or SELinux), and avoid privileged containers except where unavoidable. Keep host kernels current, since a container escape frequently rides on the same kernel bugs that enable local escalation. In shared environments, the kernel is the shared fate of every tenant — patch it accordingly.

Conclusion

The journey from a low-privileged foothold to root is the pivotal moment in most Linux intrusions, and the bugs that enable it — PwnKit, Dirty Pipe, Looney Tunables, Baron Samedit — are neither obscure nor unpatched-by-necessity. They were all fixed. What separated the compromised from the safe was speed, visibility, and disciplined least privilege. Kernel or userland, the pattern is consistent: reduce the privileged attack surface, patch what actively matters, and watch for the escalation attempt when it comes.

If your organization runs Linux at scale, Honeybadger Solutions LLC can help you close that gap. As a Service-Disabled Veteran-Owned Small Business specializing in cybersecurity, digital forensics, and incident response, we help clients build KEV-driven vulnerability management programs, harden their Linux attack surface, and investigate suspected privilege escalation and post-compromise activity. If you have found evidence of an intrusion, or simply want to know whether a threat actor could get from foothold to root on your systems, reach out to talk with our team about Linux forensics, incident response, and vulnerability management.

About Honeybadger Solutions

Honeybadger Solutions LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) delivering cybersecurity, digital forensics, and investigative services to clients nationwide. Whether you are dealing with a compromised device, a suspected intrusion, or you simply want to get ahead of these threats, our team can help.

What we do:

  • Digital forensics — mobile devices (iPhone, Android) and computers (Windows, macOS, Linux); intrusion reconstruction, evidence preservation, and expert-witness reporting
  • Cybersecurity & incident response — breach investigation, containment, malware and spyware analysis, and remediation
  • Penetration testing & security assessments — finding the gaps before an attacker does
  • Managed IT & endpoint security — hardening, monitoring, and patch management for small and mid-sized organizations
  • Private investigations — including TSCM / technical surveillance countermeasures (“bug sweeps”)
  • Executive & personal protection

📞 (602) 725-2818 · 🌐 honeybadgersolution.com · Veteran-Owned (SDVOSB) · Licensed & Insured

Concerned a device or network may already be compromised? Contact Honeybadger Solutions for a confidential consultation — we handle mobile and computer forensics, incident response, and everything above.

Related from the Honeybadger Linux security series

Part of Honeybadger Solutions’ security-intelligence series. Explore the rest of the Linux coverage:

Sources

Something that cannot wait for business hours? Urgent and after-hours intake — read seven days a week. If anyone is hurt or in immediate danger, call 911.