Multiple Local Vulnerabilities in PackageKit
Multiple vulnerabilities in PackageKit allow a local attacker to bypass security restrictions, achieve root-level arbitrary command execution, perform privilege escalation, and access or manipulate sensitive data.
The BSI has released an advisory regarding multiple security vulnerabilities discovered within PackageKit, a toolkit designed to provide a consistent and high-level interface for software management across various Linux distributions. These vulnerabilities are exploitable by a local attacker who already has minimal access to the system. By leveraging flaws in how PackageKit processes package management requests or interacts with system services, an attacker can bypass existing security restrictions. Successful exploitation of these flaws allows the attacker to execute arbitrary commands with root privileges, escalate their local user permissions, or disclose and manipulate sensitive data stored or managed via the PackageKit backend. Given PackageKit's integration in numerous desktop environments and server-side package management tools, these vulnerabilities represent a significant risk for privilege escalation within Linux-based operating systems. Defenders should prioritize patching PackageKit versions in their environments to the latest stable release provided by their distribution vendors.
Impact
Local attackers can gain full control over affected Linux systems by escalating privileges from an unprivileged user account to root. This allows for total system compromise, including the exfiltration of sensitive information, the installation of persistent rootkits, or the destruction of data. These vulnerabilities affect any system running PackageKit that allows local user access, particularly multi-user environments or systems where untrusted users can execute commands or interact with the local package manager.
Recommendation
- Identify all systems running PackageKit across the infrastructure.
- Apply security patches provided by the respective Linux distribution vendor (e.g., Debian, Fedora, RHEL, Ubuntu) immediately as they become available.
- Restrict local system access to authorized users only to mitigate the risk of local exploitation.
- Implement monitoring for unexpected process execution patterns initiated by system management tools.
Immediate actions
Audit systems for PackageKit installations and prepare to apply vendor patches.
Mitigations
Upgrade PackageKit packages to the version provided by the distribution vendor.
Local privilege escalation in PackageKit