PackageKit up to 1.3.4 src/pk-transaction.c InstallFiles toctou

Summaryinfo

A vulnerability was found in PackageKit up to 1.3.4 and classified as problematic. Affected is the function InstallFiles of the file src/pk-transaction.c. Executing a manipulation can lead to toctou. This vulnerability is tracked as CVE-2026-41651. The attack is restricted to local execution. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in PackageKit up to 1.3.4 and classified as problematic. This vulnerability affects the function InstallFiles of the file src/pk-transaction.c. The manipulation with an unknown input leads to a toctou vulnerability. The CWE definition for the vulnerability is CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`: 1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction has already been authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING. 2. Silent state-transition rejection (lines 873–882): `pk_transaction_set_state()` silently discards backward state transitions (e.g. `RUNNING` → `WAITING_FOR_AUTH`) but the flag overwrite at step 1 already happened. The transaction continues running with corrupted flags. 3. Late flag read at execution time (lines 2273–2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at authorization time. If flags were overwritten between authorization and execution, the backend sees the attacker's flags.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-41651 since 04/22/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 311124 (RHEL 8 : PackageKit (RHSA-2026:11635)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.3.5 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (311124), EUVD (EUVD-2026-24742) and CERT Bund (WID-SEC-2026-1233). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Open Source PackageKit

Productinfo

Name

• PackageKit

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4

Website

• Product: https://github.com/PackageKit/PackageKit/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion