dnf5daemon-server up to 5.1.9 Configuration Dictionary input validation

Summaryinfo

A vulnerability classified as problematic was found in dnf5daemon-server up to 5.1.9. This affects an unknown function of the component Configuration Dictionary Handler. The manipulation results in an unknown weakness. This vulnerability is known as CVE-2024-1929. Attacking locally is a requirement. Furthermore, an exploit is available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability classified as critical has been found in dnf5daemon-server up to 5.1.9. Affected is an unknown function of the component Configuration Dictionary Handler. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configuration Dictionary. There are issues with the D-Bus interface long before Polkit is invoked. The `org.rpm.dnf.v0.SessionManager.open_session` method takes a key/value map of configuration entries. A sub-entry in this map, placed under the "config" key, is another key/value map. The configuration values found in it will be forwarded as configuration overrides to the `libdnf5::Base` configuration.  Practically all libdnf5 configuration aspects can be influenced here. Already when opening the session via D-Bus, the libdnf5 will be initialized using these override configuration values. There is no sanity checking of the content of this "config" map, which is untrusted data. It is possible to make the library loading a plug-in shared library under control of an unprivileged user, hence achieving root access. 

The weakness was published 03/05/2024. The advisory is shared for download at seclists.org. This vulnerability is traded as CVE-2024-1929 since 02/27/2024. Technical details are unknown but an exploit is available.

It is declared as proof-of-concept.

Applying a patch is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• dnf5daemon-server

Version

• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.1.6
• 5.1.7
• 5.1.8
• 5.1.9

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion