Описание
PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on transaction->cached_transaction_flags combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in src/pk-transaction.c: 1. Unconditional flag overwrite (line 4036): InstallFiles() writes caller-supplied flags to transaction->cached_transaction_flags without checking whether the transaction ...
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.3.5-1 |
| esm-infra-legacy/xenial | released | 0.8.17-4ubuntu6~gcc5.4ubuntu1.5+esm1 |
| esm-infra/bionic | released | 1.1.9-1ubuntu2.18.04.6+esm1 |
| esm-infra/focal | released | 1.1.13-2ubuntu1.1+esm1 |
| esm-infra/xenial | released | 0.8.17-4ubuntu6~gcc5.4ubuntu1.5+esm1 |
| jammy | released | 1.2.5-2ubuntu3.1 |
| noble | released | 1.2.8-2ubuntu1.5 |
| questing | released | 1.3.1-1ubuntu1.1 |
| resolute | released | 1.3.4-3ubuntu1 |
| upstream | released | 1.3.5-1 |
Показывать по
Ссылки на источники
EPSS
8.8 High
CVSS3
Связанные уязвимости
PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`: 1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction ...
PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`: 1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction ha
PackageKit is a a D-Bus abstraction layer that allows the user to mana ...
EPSS
8.8 High
CVSS3