Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-27512— Zincati allows unprivileged access to rpm-ostree D-Bus `Deploy()` and `FinalizeDeployment()` methods

Quick assessment

Affected
coreos zincati
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zincati是CoreOS开源的一个 Fedora CoreOS 自动更新代理程序。 Zincati v0.0.24至v0.0.30之前版本存在安全漏洞，该漏洞源于逻辑错误，可能导致任意用户部署旧版本。

AI Predicted 5.5 Difficulty: Easy EPSS 0.18% · P7
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-27512

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Zincati allows unprivileged access to rpm-ostree D-Bus `Deploy()` and `FinalizeDeployment()` methods
Source: CVE Program / CVE List V5
Vulnerability Description
Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actions `org.projectatomic.rpmostree1.deploy` to deploy updates to the system and `org.projectatomic.rpmostree1.finalize-deployment` to reboot the system into the deployed update. Since Zincati v0.0.24, this polkit rule contains a logic error which broadens access of those polkit actions to any unprivileged user rather than just the `zincati` system user. In practice, this means that any unprivileged user with access to the system D-Bus socket is able to deploy older Fedora CoreOS versions (which may have other known vulnerabilities). Note that rpm-ostree enforces that the selected version must be from the same branch the system is currently on so this cannot directly be used to deploy an attacker-controlled update payload. This primarily impacts users running untrusted workloads with access to the system D-Bus socket. Note that in general, untrusted workloads should not be given this access, whether containerized or not. By default, containers do not have access to the system D-Bus socket. The logic error is fixed in Zincati v0.0.30. A workaround is to manually add a following polkit rule, instructions for which are available in the GitHub Security Advisory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Source: CVE Program / CVE List V5
Vulnerability Type
操作符优先级逻辑错误
Source: CVE Program / CVE List V5
Vulnerability Title
Zincati 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Zincati是CoreOS开源的一个 Fedora CoreOS 自动更新代理程序。 Zincati v0.0.24至v0.0.30之前版本存在安全漏洞，该漏洞源于逻辑错误，可能导致任意用户部署旧版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
coreos zincati >= 0.0.24, < 0.0.30 -

II. Public POCs for CVE-2025-27512

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-27512

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-27512 (2)

Vendor Advisories for CVE-2025-27512 (1)

Vendor Pages for CVE-2025-27512 (2)

IV. Related Vulnerabilities

Same weakness: CWE-783

V. Comments for CVE-2025-27512

No comments yet

Leave a comment