PackageKit vulnerabilities

PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard (role == REPO_REMOVE || !SIMULATE) is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate.

A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

PackageKit versions 1.0.2 through 1.3.4 contain a TOCTOU race condition on transaction flags, allowing unprivileged users to install packages as root. The vulnerability stems from three code issues: unconditional flag overwrite, silent state-transition rejection, and late flag reading at execution time.