{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apackagekit_projectpackagekit/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:packagekit_project:packagekit:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-41651"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PackageKit (1.0.2 - 1.3.4)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","linux","cve-2026-41651"],"_cs_type":"advisory","_cs_vendors":["Packagekit_Project"],"content_html":"\u003cp\u003eCVE-2026-41651 is a local privilege escalation vulnerability in PackageKit versions 1.0.2 through 1.3.4. The vulnerability arises from a Time-of-check Time-of-use (TOCTOU) race condition within the D-Bus transaction handler, specifically in \u003ccode\u003esrc/pk-transaction.c\u003c/code\u003e. An unprivileged local user can exploit three chained bugs: unconditional flag overwrites, a flawed state-machine guard, and late flag reads during transaction dispatch. By utilizing the \u003ccode\u003ePK_TRANSACTION_FLAG_SIMULATE\u003c/code\u003e flag, an attacker can bypass PolKit authorization checks. This allows a local attacker to install arbitrary packages as root, ultimately facilitating the creation of SUID binaries for full system compromise. The vulnerability affects major Linux distributions, including Ubuntu, Debian, Fedora, and RockyLinux, provided the \u003ccode\u003epackagekitd\u003c/code\u003e service is active.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker initiates a D-Bus transaction with the PackageKit daemon, setting the transaction state to NEW.\u003c/li\u003e\n\u003cli\u003eThe attacker sends an \u003ccode\u003eInstallFiles()\u003c/code\u003e request with the \u003ccode\u003ePK_TRANSACTION_FLAG_SIMULATE\u003c/code\u003e flag, causing the daemon to skip PolKit authorization checks.\u003c/li\u003e\n\u003cli\u003eThe daemon moves the transaction to a READY state and queues it as a GLib idle event.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a second \u003ccode\u003eInstallFiles()\u003c/code\u003e request on the same transaction using their intended malicious payload.\u003c/li\u003e\n\u003cli\u003eThe daemon's flawed state-machine guard rejects the second state transition but fails to roll back the malicious flags and file paths overwritten in the previous step.\u003c/li\u003e\n\u003cli\u003eWhen the GLib idle event fires, \u003ccode\u003epk_transaction_run()\u003c/code\u003e is invoked, reading the attacker's corrupted flags and path instead of the authorized ones.\u003c/li\u003e\n\u003cli\u003eThe backend processes the malicious package as root, executing its post-installation script.\u003c/li\u003e\n\u003cli\u003eThe post-installation script creates a SUID binary (e.g., \u003ccode\u003e/tmp/.suid_bash\u003c/code\u003e), which the attacker executes to gain root-level privileges.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full local root privilege escalation. The vulnerability affects a wide range of Linux distributions including Ubuntu, Debian, Fedora, and RockyLinux. Any local user with an active session can exploit this to achieve persistence or system-wide compromise, impacting the integrity and availability of the affected host.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade PackageKit to version 1.3.5 or higher immediately.\u003c/li\u003e\n\u003cli\u003eIf an upgrade is not feasible, mask the PackageKit service using \u003ccode\u003esystemctl mask packagekit\u003c/code\u003e to prevent the vulnerable daemon from running.\u003c/li\u003e\n\u003cli\u003eAudit \u003ccode\u003e/tmp\u003c/code\u003e and similar temporary directories for unexpected SUID binaries, specifically looking for files created by \u003ccode\u003edpkg\u003c/code\u003e or unauthorized installation processes.\u003c/li\u003e\n\u003cli\u003eMonitor for the presence of unusual \u003ccode\u003e.deb\u003c/code\u003e packages being processed by \u003ccode\u003epackagekitd\u003c/code\u003e in environments where package management activity is typically restricted.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-02T12:42:23Z","date_published":"2026-08-02T12:42:23Z","id":"https://feed.craftedsignal.io/briefs/2026-08-packagekit-lpe/","summary":"CVE-2026-41651 is a local privilege escalation vulnerability in PackageKit that allows unprivileged users to execute arbitrary packages as root by bypassing PolKit via a TOCTOU race condition.","title":"Local Privilege Escalation in PackageKit via TOCTOU Race Condition","url":"https://feed.craftedsignal.io/briefs/2026-08-packagekit-lpe/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:packagekit_project:packagekit:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}