Açıklama

An Incorrect Authorization vulnerability (CWE-863) combined with insecure mount options in Pardus About allows an unprivileged local desktop user to achieve local privilege escalation to root. The root helper mounted discovered partitions without nosuid, nodev, or noexec semantics while the polkit policy authorized active sessions without a password challenge. Upstream addressed the execution primitive in 1.2.5 by enforcing ro,nosuid,nodev,noexec mount flags.

CVSS Vektörü

Birincil değerlendirmeTR-CERT CNA · 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV: Yerel (Local)AC: Düşük (Low)PR: Düşük (Low)UI: Yok (None)S: Değişmez (Unchanged)C: Yüksek (High)I: Yüksek (High)A: Yüksek (High)

Bildirim Durumu

Etkilenen sürümler
< 1.2.5 (verified against debian/1.2.4)
Yama durumu
Fixed in debian/1.2.5
Üretici yanıtı
Upstream mount hardening merged in commit b439777
Birincil puan kaynağı
TR-CERT CNA

Referanslar

Kayıt Doğrulama

KrediResmi CVE kaydında keşif sahibi olarak Sevban DÖNMEZ belirtilmiştir
YayınlanmaCVE kaydı 2026-11-12 tarihinde yayınlandı
KontrolMetaveriler son olarak 2026-11-12 tarihinde CVE Services kaydıyla doğrulandı

Bildirim Zaman Çizelgesi

2026-08-22Reproduction — Vulnerable behavior reproduced against pardus-about 1.2.4 in an isolated Pardus 25.2 lab.
2026-08-25Evidence package — Deterministic evidence package and negative controls completed.
2026-09-10Upstream patch — Upstream mount-hardening change and debian/1.2.5 release tag published. Kaynak ↗
2026-09-16Casefile complete — Technical casefile and root-cause analysis completed.
2026-11-12Published — TR-CERT published the CVE-2026-87772 record on CVE.org, and the SSB / USOM advisory TR-26-1521 recommended upgrading to pardus-about 1.2.5 or later. Kaynak ↗
2026-11-12Site verification — jankesec confirmed the published CVE.org record, the TR-CERT CVSS, the affected versions and the SSB advisory reference.