Critical Pardus Linux Flaw CVE-2024-3435 Lets Attackers Gain Root Access

Key Takeaways

• A critical vulnerability, CVE-2024-3435, has been discovered in Pardus Linux, allowing local privilege escalation to root.
• The flaw is a chain of three distinct weaknesses: a Polkit misconfiguration, a CRLF injection, and an untrusted file path vulnerability.
• Pardus Linux, a Debian-based distribution maintained by TÜBİTAK, is widely used in Turkish government, education, and enterprise sectors.
• The vulnerability (CVSS v3.1 score of 9.3) enables unauthenticated local users to gain full root access.
• Immediate application of a three-part fix is required to mitigate the risk.

Pardus Linux Privilege Escalation Flaw Uncovered

A severe vulnerability chain, identified as CVE-2024-3435, has been found in Pardus Linux, a Debian-based operating system. This critical flaw allows any local user to gain complete root privileges on a system without needing to authenticate. The issue, which impacts the pardus-update package, has been assigned a CVSS v3.1 score of 9.3, highlighting its significant severity.

Pardus Linux is a distribution developed and maintained by TÜBİTAK, the Scientific and Technological Research Council of Turkey. It sees extensive deployment across various sectors within Turkey, including government bodies, educational institutions, and corporate environments. This widespread use makes the discovered vulnerability particularly concerning, especially in shared or multi-user system configurations.

Security researcher Çağrı Eser (known as 0xc4gr1) is credited with identifying that this is not a singular bug but rather a combination of three distinct weaknesses. When chained together, these vulnerabilities facilitate a full system compromise. The three contributing factors are a PolicyKit (Polkit) misconfiguration, a carriage return-line feed (CRLF) injection vulnerability, and an untrusted file path flaw.

Dissecting the Vulnerability Chain

The first component of this exploit chain originates from an insecure Polkit policy configuration. Specific update actions, namely aptupdateaction and autoaptupgradeaction, were incorrectly set with "allow_any=yes". This configuration permits any user to execute privileged operations without requiring authentication, effectively granting passwordless root execution for backend Python scripts via the pkexec utility.

The second weakness resides within the SystemSettingsWrite.py script. This script is designed to write user-supplied input into a configuration file. While the script correctly filters out newline characters, it critically fails to filter carriage return characters. This oversight enables attackers to inject arbitrary configuration entries directly into the /etc/pardus/pardus-update.conf file. By carefully crafting malicious input, an attacker can insert a custom APT source path that points to a file under their control.

The final vulnerability in the chain appears in the AutoAptUpgrade.py script, which processes the manipulated configuration. This script unreservedly copies attacker-provided APT source files into the /etc/apt/sources.list.d/ directory without any form of validation. This absence of checks allows an attacker to introduce a malicious repository, subsequently triggering the installation of packages with root privileges.

Exploitation and Impact

In a proof-of-concept exploit, an attacker would set up a rogue APT repository containing a specially crafted .deb package. Upon installation, this malicious package would modify the /bin/bash executable by setting its SUID bit. This action then allows for privilege escalation. Once executed, the attacker can instantly obtain a root shell by running "/bin/bash -p", achieving full control over the compromised system.

The consequences of this vulnerability are severe. Attackers can gain unrestricted access to sensitive system files, such as /etc/shadow, which contains hashed user passwords. They can install persistent backdoors, modify core system binaries, and exert complete control over the compromised machine. The exploit requires only local access and no user interaction, making it highly attractive to threat actors in shared computing environments or as a post-initial compromise vector.

As detailed in a report by nullsecurityx, this vulnerability chain serves as a stark reminder of how multiple seemingly minor misconfigurations, when combined, can lead to a critical security breach.

What You Should Do

• Update Polkit Policies: Administrators must immediately modify the Polkit policy configurations to mandate administrator authentication for critical update actions, replacing the permissive “allow_any=yes” setting.
• Sanitize User Input: Ensure that the SystemSettingsWrite.py script rigorously sanitizes all user-provided input, specifically filtering out both carriage return and newline characters to prevent injection attacks.
• Restrict APT Source Paths: Configure the AutoAptUpgrade.py script to strictly limit APT source file paths to trusted directories only, explicitly blocking any world-writable locations to prevent the introduction of malicious repositories.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.