Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2024-1929— Local Root Exploit via Configuration Dictionary

Quick assessment

Affected

Fedora dnf5daemon-server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

DNF5是rpm-software-management开源的一个命令行包管理器。 DNF5 daemon-server 5.1.17 之前版本存在安全漏洞，该漏洞源于允许恶意用户通过配置字典影响机密性和完整性。

CVSS 7.5 · High EPSS 0.29% · P21 Updated Jan 25, 2025

Possible ATT&CK Techniques 3 AI

T1055 · Process Injection T1621 · Multi-Factor Authentication Request Generation T1574.007 · Path Interception by PATH Environment Variable

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-1929

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Local Root Exploit via Configuration Dictionary

Source: CVE Program / CVE List V5

Vulnerability Description

Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configuration Dictionary. There are issues with the D-Bus interface long before Polkit is invoked. The `org.rpm.dnf.v0.SessionManager.open_session` method takes a key/value map of configuration entries. A sub-entry in this map, placed under the "config" key, is another key/value map. The configuration values found in it will be forwarded as configuration overrides to the `libdnf5::Base` configuration. Practically all libdnf5 configuration aspects can be influenced here. Already when opening the session via D-Bus, the libdnf5 will be initialized using these override configuration values. There is no sanity checking of the content of this "config" map, which is untrusted data. It is possible to make the library loading a plug-in shared library under control of an unprivileged user, hence achieving root access.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

输入验证不恰当

Source: CVE Program / CVE List V5

Vulnerability Title

DNF5 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Fedora	dnf5daemon-server	5.1.16<=	-

II. Public POCs for CVE-2024-1929

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2024-1929

请登录查看更多情报信息。

Mailing List Discussions for CVE-2024-1929 (1)

oss-security - dnf5daemon-server: Local root Exploit and Local Denial-of-Service in dnf5 D-Bus Components (CVE-2024-1929, CVE-2024-1930)

https://www.cve.org/CVERecord?id=CVE-2024-1929

Same Patch Batch · Fedora · 2024-05-08 · 3 CVEs total

CVE-2024-2746	8.8 HIGH	Incomplete fix for CVE-2024-1929
CVE-2024-1930	6.5 MEDIUM	No Limit on Number of Open Sessions / Bad Session Close Behaviour

IV. Related Vulnerabilities

Same product: dnf5daemon-server

Same vendor: Fedora

Same weakness: CWE-20