Arbitrary Configuration Parameter Injection Vulnerability in dnf5 D-Bus Daemon

CVE-2024-2746

What is CVE-2024-2746?

The DNF5 D-Bus daemon contains an incomplete fix for a previously identified vulnerability, allowing local attackers to exploit configuration parameters accepted from unprivileged users. This flaw permits potential local root privileges by misleading the daemon into processing user-controlled plugins before Polkit authentication occurs. The absence of directory ownership checks on the part of the dnf5 library exacerbates the situation, introducing avenues for Denial-of-Service attacks and facilitating access to sensitive files such as /etc/shadow. Additionally, an attacker might create a valid repository configuration file, thereby exposing various code paths within libdnf5 that can be manipulated for further malicious activities. The potential for information leak exists through error diagnostics from parsing privileged files, which, despite the theoretical safeguards, may become a point of vulnerability.

References