coreos zincati up to 0.0.29 operator precedence logic error

Summaryinfo

A vulnerability has been found in coreos zincati up to 0.0.29 and classified as problematic. This affects an unknown part. The manipulation leads to operator precedence logic error. This vulnerability is traded as CVE-2025-27512. An attack has to be approached locally. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in coreos zincati up to 0.0.29 and classified as problematic. This issue affects an unknown part. The manipulation with an unknown input leads to a operator precedence logic error vulnerability. Using CWE to declare the problem leads to CWE-783. The product uses an expression in which operator precedence causes incorrect logic to be used. Impacted is integrity. The summary by CVE is:

Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actions `org.projectatomic.rpmostree1.deploy` to deploy updates to the system and `org.projectatomic.rpmostree1.finalize-deployment` to reboot the system into the deployed update. Since Zincati v0.0.24, this polkit rule contains a logic error which broadens access of those polkit actions to any unprivileged user rather than just the `zincati` system user. In practice, this means that any unprivileged user with access to the system D-Bus socket is able to deploy older Fedora CoreOS versions (which may have other known vulnerabilities). Note that rpm-ostree enforces that the selected version must be from the same branch the system is currently on so this cannot directly be used to deploy an attacker-controlled update payload. This primarily impacts users running untrusted workloads with access to the system D-Bus socket. Note that in general, untrusted workloads should not be given this access, whether containerized or not. By default, containers do not have access to the system D-Bus socket. The logic error is fixed in Zincati v0.0.30. A workaround is to manually add a following polkit rule, instructions for which are available in the GitHub Security Advisory.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-27512 since 02/26/2025. The exploitation is known to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 233748 (Fedora 41 : rust-zincati (2025-cc269f80fa)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.0.30 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 01d8e89f799e6ba21bdf7dc668abce23bd0d8f78 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (233748). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• coreos

Name

• zincati

Version

• 0.0.1
• 0.0.2
• 0.0.3
• 0.0.4
• 0.0.5
• 0.0.6
• 0.0.7
• 0.0.8
• 0.0.9
• 0.0.10
• 0.0.11
• 0.0.12
• 0.0.13
• 0.0.14
• 0.0.15
• 0.0.16
• 0.0.17
• 0.0.18
• 0.0.19
• 0.0.20
• 0.0.21
• 0.0.22
• 0.0.23
• 0.0.24
• 0.0.25
• 0.0.26
• 0.0.27
• 0.0.28
• 0.0.29

License

• open-source

Website

• Product: https://github.com/coreos/zincati/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion