Zimbalwa izinsuku ezedlule Kukhishwe ulwazi mayelana nobuthakathaka obusha obubucayi lokho kuthinta izindawo ze-Linux ezibizwa ngokuthi "I-Pack2TheRoot". Ifakwe kuhlu ngaphansi kwe-CVE-2026-41651Leli phutha lithinta i-PackageKit (ithuluzi elisebenza njengesendlalelo sokususa i-D-Bus ukuhlanganisa ukuphathwa kwephakheji kuzo zonke izabelo eziningi)
Kukhulunywe ukuthi isinqumo Ivumela noma yimuphi umsebenzisi wendawo ongenamalungelo okufaka noma ukususa amaphakheji ngokunganaki. Ngokusebenzisa lobu buthakathaka, umhlaseli angathola ukufinyelela okugcwele kwezimpande ohlelweni oluphazamisekile. Umthelela mkhulu, uma ubheka ukuthi inkinga ibilokhu ikhona kusukela kunguqulo 1.0.2, eyakhishwa eminyakeni engaphezu kweyishumi nambili eyedlule (ngo-2014), futhi ithinta ukucushwa okuzenzakalelayo kokusatshalaliswa okudumile njenge-Ubuntu, i-Debian, i-Rocky Linux, ne-Fedora.
I-Pack2TheRoot: Ubungozi be-PackageKit bunikeza ukufinyelela komlawuli ku-Linux
El Ukutholakala kwe-Pack2TheRoot kwaba umphumela wophenyo eholwa yi-Red Team ye-Deutsche Telekom, eyathi Basebenzise imodeli yobuhlakani bokwenziwa yeClaude Opus ukuqondisa ukuhlaziywa kwabo kwezindlela zokukhulisa amalungelo endawo.
LoAbacwaningi baqale baphawula ukuthi umyalo wokufaka i-pkcon ungasetshenziswa ngaphandle kokudinga iphasiwedi.kwezinye izilungiselelo ze-Fedora, okwaphakamisa izinsolo mayelana nokugunyazwa okuyisisekelo. Ngemva kokuqinisekisa nokubika ngokuzibophezela ubuthakathaka kubanakekeli be-PackageKit, Kuye kwasungulwa iqhinga lokusebenza, yize ukushicilelwa kwayo okuningiliziwe kuye kwahlehliswa ngokwecebo ukuze kuvunyelwe abasebenzisi nabaphathi ukuthi basebenzise izibuyekezo ezidingekayo.
Indlela yokuhlasela
Umsuka we Ubuthakathaka busesimeni somsebenzi (Uhlobo lwe-TOCTOU: Isikhathi Sokuhlola Isikhathi Sokusebenzisa) ngaphakathi ukuphathwa kokuthengiselana kwenqubo yangemuva (i-daemon) ye-PackageKitI-PackageKit, esebenza njengomsebenzisi oyinhloko, idlulisela ukugunyazwa ohlelweni lwe-polkit. Uma iklayenti licela ukufaka iphakheji, isibonelo kusetshenziswa indlela ye-InstallFiles, lidlulisela isethi yamafulegi aqondisa ukuziphatha kwentengiselwano.
Amafulegi athile, njenge-SIMULATE noma i-ONLY_DOWNLOAD, ayala i-PackageKit ukuthi yeqe ukugunyazwa kwe-polkit. njengoba zimelela imisebenzi ephephile, ngokombono, engashintshi isimo sohlelo. Ukwehluleka kubangelwa ukuthi umphathi wentengiselwano ubhala ngaphezulu Lezi zinkomba zigcinwa ngokungenamibandela ngekholi ngayinye entsha, ngaphandle kokuqinisekisa ukuthi ukuthengiselana sekuvele kugunyaziwe noma kusenqubo yokwenziwa.
Un Umhlaseli angaqala ukuthengiselana esebenzisa izinkomba "eziphephile" (ngaleyo ndlela begwema ukugunyazwa yi-polkit) futhi, ngemva kwama-millisecond, thumela isicelo sesibili se-D-Bus ngentengiselwano efanayo, kodwa kulokhu ngamafulegi anonya ayalela ukufakwa kwangempela. Ngenxa yokwakheka kwe-GLib's event loop priority architecture (lapho imiyalezo ye-D-Bus icutshungulwa ngaphambi kokuphinda kusebenze), isicelo sesibili sibhala ngaphezulu kwamapharamitha ngaphambi nje kokuba umhleli aqale ukusebenza.
Ngenxa yalokho, ukuthengiselana okwakuvunyelwe ngaphambilini ngokuthi "kuphephile" kwenziwa ngamapharamitha afakwe esikhundleni salokho., ukufaka iphakheji enamalungelo okuphatha.
Izixazululo kanye nokunciphisa
Kufanele kuqashelwe ukuthi Ubungozi bulungisiwe ku-PackageKit version 1.3.5Ngakho-ke, abathuthukisi banxusa abaphathi bezinhlelo ukuthi bahlole ukuthi izinhlelo zabo zisengozini yini ngokuhlola isimo sesevisi besebenzisa imiyalo efana ne-systemctl status packagekit noma ngokuqapha umsebenzi nge-pkmon.
I-Las Ukusabalalisa okukhulu, okuhlanganisa i-Debian, Ubuntu, kanye ne-Fedora, sekuqalile kakade ukusabalalisa amaphakheji. Izibuyekezo zikhishwa ngeziteshi zabo ezisemthethweni. Ezinhlelweni lapho i-patch ingatholakali khona ngokushesha, abacwaningi baphakamise indlela yokuxazulula inkinga: ukusebenzisa umthetho we-polkit owenziwe ngokwezifiso.
Lona Umthetho uyaphika ngokushesha futhi buthule izenzo zokufaka i-PackageKit. Kunoma yimuphi umsebenzisi ngaphandle kwempande, lokhu kuvimbela iwindi lesimo somjaho ukuthi livuleke. Kubalulekile ukuqaphela ukuthi, yize i-exploit ishesha futhi ithule, ishiya umkhondo ocacile kumarekhodi esistimu: ngemuva kwe-exploit ephumelelayo, i-daemon ye-PackageKit iyaphahlazeka ngenxa yokwehluleka kwe-assertion (assertion failed: (!transaction->priv->emitted_finished)). Nakuba i-systemd iqala kabusha isevisi, ivimbela ukuhlaselwa kwe-denial-of-service, ukuba khona kwalo mlayezo ku-journalctl kuyisibonakaliso esinamandla sokuthi uhlelo luye lwaphazamiseka.
Okokugcina, uma unesithakazelo sokufunda okwengeziwe ngalokhu, ungaxhumana ne- imininingwane kusixhumanisi esilandelayo.