A high-severity local privilege escalation vulnerability in PackageKit (versions 1.0.2 to 1.3.4) allows unprivileged users to execute arbitrary code as root.

This vulnerability is a time-of-check time-of-use (TOCTOU) race condition within the transaction flag handling logic in src/pk-transaction.c. An unprivileged local attacker can trigger this flaw to bypass security checks and install arbitrary RPM packages with root privileges.

The ability for an unprivileged user to gain root access constitutes a critical security failure, as it allows for complete system compromise, data theft, and persistence establishment. With a CVSS score of 8.8, this flaw represents a significant risk to host integrity and confidentiality. Organizations relying on PackageKit for system updates must prioritize remediation to prevent lateral movement or full host takeover by malicious actors.

Immediate Action: Update the PackageKit software to version 1.3.5 or later, which includes the necessary patches to address the race condition.

Proactive Monitoring: Review system audit logs and package manager logs for unusual installation activity or frequent, failed transaction attempts that may indicate exploitation testing.

Compensating Controls: Restrict access to the D-Bus interface and limit the ability of non-privileged users to invoke package installation commands if the update cannot be applied immediately.

Public Exploit Available: Yes, multiple public proof-of-concept repositories exist on GitHub.

Given the availability of public proof-of-concept code and the high potential impact of total system compromise, this vulnerability poses a substantial threat to local environment security. Administrators should treat this as a high-priority patching task and deploy the 1.3.5 update across all affected Linux distributions immediately to eliminate the risk of privilege escalation.