Pardus About: Local privilege escalation (CVE-2026-87772)
The Pardus About utility contains a local privilege escalation vulnerability that allows unprivileged users to execute setuid-root binaries by leveraging improper Polkit authorization and unsafe mount options.
CVE search metadata
CVE search record: CVE-2026-87772. Severity: high. CVSS: 7.8. KEV: no. Product: pardus-about (< 1.2.5). Brief: Pardus About: Local privilege escalation (CVE-2026-87772). Brief link: https://feed.craftedsignal.io/briefs/2026-11-pardus-priv-esc-cve-2026-87772/
Triage facts
Revision 1- Applicability
- pardus-about (< 1.2.5)
- Evidence
- Not observed
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 12, 09:29 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
CVE-2026-87772 is a local privilege escalation vulnerability in the Pardus About utility. The vulnerability allows an unprivileged user with an active local desktop session to execute a root-privileged helper without authentication. This helper mounts attached partitions using insecure defaults that fail to set the nosuid flag, enabling the execution of setuid-root binaries.
Attack Chain
- An unprivileged user with an active desktop session triggers a root helper via Polkit without authentication.
- The helper mounts a partition controlled by the user with insecure options.
- The user executes a setuid-root binary from the mounted partition to gain root privileges.
Impact
Successful exploitation allows an unprivileged local user to obtain root-level control over the target system.
Recommendation
Upgrade the Pardus About utility to version 1.2.5 or later. Alternatively, modify the Polkit policy for the affected action to require administrative authentication.
Threat Hunt
Identify execution of the 'pardus-about' helper or 'pkexec' for the 'tr.org.pardus.pkexec.pardus-about.system_info' action initiated by unprivileged users. Search for command-line arguments involving 'dualboot' or mount operations at '/run/winroot' that coincide with the absence of 'nosuid' in system mount logs.
Data: process_execution_logs, system_mount_logs, polkit_authorization_logs
Monitor for the creation of files with the setuid bit enabled on external or loop-mounted devices, followed by the execution of these files. Specifically look for processes executing from the '/run/winroot' directory path.
Data: file_creation_events, process_execution_logs