Описание
PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5.
A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on transaction->cached_transaction_flags combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in src/pk-transaction.c:
- Unconditional flag overwrite (line 4036):
InstallFiles()writes caller-supplied flags totransaction->cached_transaction_flagswithout checking whether the transaction has already been authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING. - Silent state-transition rejection (lines 873–882):
pk_transaction_set_state()silently discards backward state transitions (e.g.RUNNING→WAITING_FOR_AUTH) but the flag overwrite at step 1 already happened. The transaction continues running with corrupted flags. - Late flag read at execution time (lines 2273–2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at authorization time. If flags were overwritten between authorization and execution, the backend sees the attacker's flags.
A flaw was found in PackageKit. A time-of-check time-of-use (TOCTOU) race condition on transaction flags allows unprivileged users to install packages as root, resulting in a local privilege escalation.
Отчет
To exploit this issue, an attacker needs local access to the system and basic permissions to install packages via PackageKit, limiting its exposure to authenticated users. As this flaw allows a local user to escalate its privileges, specifically gaining administrative permissions, this vulnerability has been rated with an important severity.
Меры по смягчению последствий
To mitigate this vulnerability, mask the PackageKit service. Note that graphical package managers, such as GNOME software, will not work as expected until the service is unmasked.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | PackageKit | Not affected | ||
| Red Hat Enterprise Linux 7 | compat-PackageKit08 | Not affected | ||
| Red Hat Enterprise Linux 10 | PackageKit | Fixed | RHSA-2026:19141 | 19.05.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | PackageKit | Fixed | RHSA-2026:19601 | 20.05.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | PackageKit | Fixed | RHSA-2026:22146 | 01.06.2026 |
| Red Hat Enterprise Linux 8 | PackageKit | Fixed | RHSA-2026:11635 | 29.04.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | PackageKit | Fixed | RHSA-2026:17558 | 14.05.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | PackageKit | Fixed | RHSA-2026:17558 | 14.05.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | PackageKit | Fixed | RHSA-2026:17561 | 14.05.2026 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | PackageKit | Fixed | RHSA-2026:17561 | 14.05.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`: 1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction ...
PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`: 1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction ha
PackageKit is a a D-Bus abstraction layer that allows the user to mana ...
EPSS
8.8 High
CVSS3