Description

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-14T20:16:43.760Z",
  "pubdate": "2026-09-14T20:16:43.760Z",
  "executiveSummary": "A critical authorization bypass vulnerability exists within the PackageKit dnf5 backend, specifically regarding the handling of SIMULATE (dry-run) transactions. The vulnerability arises from an flawed conditional guard in the RepoRemove handler, which inadvertently permits unprivileged local users to execute unauthorized package removals.\nPackageKit is designed to offload sensitive system operations to polkit; however, by asserting the SIMULATE flag, the framework skips standard authorization checks. Due to a logical error in the dnf5 backend's RepoRemove implementation, the system ignores the simulation request and proceeds with a live package removal operation. This effectively circumvents system policy enforcement, granting an unprivileged attacker the ability to uninstall packages, potentially leading to system instability, the removal of security-critical software, or denial-of-service conditions.\nThe vulnerability is restricted to systems utilizing the dnf5 backend for PackageKit. Successful exploitation requires local access but circumvents the intended privilege boundaries defined by polkit, presenting a significant security risk for multi-user environments where package management operations must be strictly gated by administrative credentials.",
  "technicalDetails": "The vulnerability is rooted in an improperly implemented conditional guard within the PackageKit dnf5 backend codebase. The architectural design of PackageKit mandates that any transaction marked with the SIMULATE flag bypasses the polkit authorization check, as these operations are intended to be read-only dry-runs that provide the user with feedback without modifying the system state.\nWithin the dnf5 backend, the RepoRemove handler performs a logical evaluation to determine whether to enforce authorization or execute a simulation. The guard condition is defined as (role == REPO_REMOVE || !SIMULATE). Because the Boolean expression uses an OR operator, the condition evaluates to true whenever the role is REPO_REMOVE, regardless of whether the SIMULATE flag is active or inactive. Consequently, the backend logic ignores the developer's intent to simulate and defaults to the execution of the actual transaction logic.\nThe exploitation flow proceeds as follows: An unprivileged local attacker invokes the PackageKit API (e.g., via a D-Bus interface) to request a repository removal transaction. The attacker includes the SIMULATE flag in the request, which informs the PackageKit daemon that an authorization check is not required. The daemon passes the transaction to the dnf5 backend. The RepoRemove handler receives the request, evaluates the flawed condition, and concludes that the transaction should proceed without triggering the expected polkit verification. The backend then executes the underlying dnf5 command necessary to remove the package, despite the user's lack of administrative privileges to perform such an action.\nThis vulnerability highlights a critical failure in enforcing policy-based security controls when dealing with transaction flags. By manipulating the transaction role and flag combination, an attacker forces the system into a state where administrative commands are executed under the context of the PackageKit service, effectively bypassing mandatory access controls. Post-exploitation impact includes the arbitrary removal of system packages, which can be leveraged to disable security agents, break system dependencies, or facilitate a persistent denial-of-service state for specific applications or the entire operating system."
}