« Volver al listado

CVE-2024-1929

Estado: AnalizadaAlta (8.4)—

Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configuration Dictionary.

There are issues with the D-Bus interface long before Polkit is invoked. The `org.rpm.dnf.v0.SessionManager.open_session` method takes a key/value map of configuration entries. A sub-entry in this map, placed under the "config" key, is another key/value map. The configuration values found in it will be forwarded as configuration overrides to the `libdnf5::Base` configuration.

Practically all libdnf5 configuration aspects can be influenced here. Already when opening the session via D-Bus, the libdnf5 will be initialized using these override configuration values.

Leer descripción completaMostrar menos

There is no sanity checking of the content of this "config" map, which is untrusted data. It is possible to make the library loading a plug-in shared library under control of an unprivileged user, hence achieving root access.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

RPM — Dnf5

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-1929",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-1929",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-08T15:00:01.200516Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "patrick@puiterwijk.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 1.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "patrick@puiterwijk.org",
      "affectedData": [
        {
          "vendor": "Fedora",
          "product": "dnf5daemon-server",
          "versions": [
            {
              "status": "affected",
              "version": "5.1.16<="
            }
          ],
          "platforms": [
            "Linux"
          ],
          "packageName": "dnf5daemon-server",
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:fedora:dnf5daemon-server:*:*:*:*:*:*:*:*"
          ],
          "vendor": "fedora",
          "product": "dnf5daemon-server",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "5.1.16"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:fedora:dnf5daemon-server:*:*:*:*:*:*:*:*"
          ],
          "vendor": "fedora",
          "product": "dnf5daemon-server",
          "versions": [
            {
              "status": "affected",
              "version": "pkg:github/rpm-software-management/dnf5@0",
              "lessThan": "pkg:github/rpm-software-management/dnf5@5.1.16",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-08T02:15:09.300",
  "references": [
    {
      "url": "https://www.openwall.com/lists/oss-security/2024/03/04/2",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "patrick@puiterwijk.org"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2024/03/04/2",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "patrick@puiterwijk.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Local Root Exploit via Configuration Dictionary  in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configuration Dictionary.\n\nThere are issues with the D-Bus interface long before Polkit is invoked. The `org.rpm.dnf.v0.SessionManager.open_session` method takes a key/value map of configuration entries. A sub-entry in this map, placed under the \"config\" key, is another key/value map. The configuration values found in it will be forwarded as configuration overrides to the `libdnf5::Base` configuration. \n\nPractically all libdnf5 configuration aspects can be influenced here. Already when opening the session via D-Bus, the libdnf5 will be initialized using these override configuration values. There is no sanity checking of the content of this \"config\" map, which is untrusted data. It is possible to make the library loading a plug-in shared library under control of an unprivileged user, hence achieving root access. \n\n"
    },
    {
      "lang": "es",
      "value": "El exploit de raíz local a través del diccionario de configuración en dnf5daemon-server anterior a 5.1.17 permite que un usuario malintencionado afecte la confidencialidad y la integridad a través del diccionario de configuración. Hay problemas con la interfaz D-Bus mucho antes de que se invoque Polkit. El método `org.rpm.dnf.v0.SessionManager.open_session` toma un mapa clave/valor de las entradas de configuración. Una subentrada en este mapa, ubicada debajo de la clave \"config\", es otro mapa de clave/valor. Los valores de configuración que se encuentran en él se reenviarán como anulaciones de configuración a la configuración `libdnf5::Base`. Aquí se pueden influir prácticamente todos los aspectos de configuración de libdnf5. Ya al abrir la sesión a través de D-Bus, libdnf5 se inicializará utilizando estos valores de configuración de anulación. No hay ninguna verificación de cordura del contenido de este mapa de \"configuración\", que son datos que no son de confianza. Es posible hacer que la librería cargue una librería compartida de complemento bajo el control de un usuario sin privilegios, logrando así acceso de root."
    }
  ],
  "lastModified": "2026-06-17T07:05:26.117",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rpm:dnf5:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7041198-E221-4AED-B6EB-1689C8131E30",
              "versionEndExcluding": "5.1.17"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "patrick@puiterwijk.org"
}