Multiple Arbitrary Code Execution Vulnerabilities in RPM

The German Federal Office for Information Security (BSI) has released an advisory regarding multiple vulnerabilities within the RPM (RPM Package Manager) utility. These flaws are currently unpatched and present a significant risk to Linux distributions relying on RPM for software management. The vulnerabilities are triggered during the handling and installation of specially crafted RPM packages. An attacker capable of delivering a malicious package to a system administrator or automated package management process could exploit these flaws to execute arbitrary code with the privileges of the user or process performing the installation. Given the widespread use of RPM across enterprise Linux environments, this impact is considered critical for systems that frequently ingest third-party or untrusted software repositories.

Impact

Successful exploitation allows for complete system compromise, including the installation of persistent backdoors, data exfiltration, or the deployment of ransomware. The scope of impact extends to all Linux distributions utilizing RPM, affecting server, desktop, and containerized environments.

Recommendation

Prioritized actions for security teams:

• Monitor system logs for unexpected executions of the 'rpm' or 'dnf' binaries, particularly those occurring in automated build pipelines or unusual user contexts.
• Implement strict repository validation policies to ensure only signed packages from trusted sources are ingested.
• Audit build and deployment pipelines to identify automated processes that automatically pull and install RPM packages from external, non-verified sources.
• Restrict local installation of RPM packages to authorized administrators only.
• Monitor vendor-specific security mailing lists and repository mirrors for the release of security patches addressing these specific RPM vulnerabilities.