CyberRota Analysis
AI-GeneratedA vulnerability in F5's PackageKit allows unprivileged local users to bypass authorization checks when using the dnf5 backend, enabling them to execute real package uninstalls while falsely claiming to perform a dry run. This flaw poses a high risk as it can lead to unauthorized software removal, potentially disrupting system integrity and availability. Organizations utilizing PackageKit with the dnf5 backend should prioritize patching this vulnerability to mitigate the risk of unauthorized actions by local users.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.