{"id":169876,"date":"2026-04-24T12:24:33","date_gmt":"2026-04-24T10:24:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-packagekit-pozvolyayushhaya-poluchit-prava-root-v-raznyh-distributivah-linux"},"modified":"2026-04-24T12:24:33","modified_gmt":"2026-04-24T10:24:33","slug":"uyazvimost-v-packagekit-pozvolyayushhaya-poluchit-prava-root-v-raznyh-distributivah-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-packagekit-pozvolyayushhaya-poluchit-prava-root-v-raznyh-distributivah-linux","title":{"rendered":"PackageKitis leitud haavatavus, mis v\u00f5imaldab Linuxi erinevates distributsioonides saada root-\u00f5igusi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

PackageKitis, D-Bus-i vahekiht, mis \u00fchtlustab pakihalduse toimingud, tuvastati haavatavus Pack2TheRoot (CVE-2026-41651), mis v\u00f5imaldab madala \u00f5igusega kasutajal paigaldada v\u00f5i eemaldada juhuslikku paketti ning saada root-juurdep\u00e4\u00e4su s\u00fcsteemile. Probleem ilmneb alates versioonist 1.0.2 (2014. aasta) ja on k\u00f5rvaldatud PackageKit 1.3.5 v\u00e4ljaandes. <\/p>\n

Probleemi tuvastasid Deutsche Telekomi teadlased AI mudeli Claude Opus abil. T\u00f6\u00f6riist, mis toimib enamikus distributsioonides PackageKit\u2019iga, on juba valmis, kuid selle ja haavatavuse \u00fcksikasjad kavatsetakse avaldada hiljem, et anda kasutajatele aega oma s\u00fcsteemide uuendamiseks. Haavatavuse \u00e4rakasutamise v\u00f5imalust demonstreeriti Ubuntu Desktop 18.04\/24.04.4\/26.04, Ubuntu Server 22.04 \u2014 24.04, Debian Desktop 13.4, RockyLinux Desktop 10.1 ja Fedora 43 Desktop\/Server. Haavatavuste parandamise staatust distributsioonides saab hinnata nende lehek\u00fclgede kaudu (kui leht ei ole saadaval, t\u00e4hendab see, et distributsiooni arendajad ei ole probleemiga veel tegelenud): Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch, Fedora, FreeBSD. <\/p>\n

Haavatavus tuleneb v\u00f5istlusolukorrast tehinguflaggide t\u00f6\u00f6tlemisel PackageKiti taustprotsessis, mis v\u00f5imaldab muuta operatsiooni parameetreid hetkel, kui autoriseerimine on l\u00e4biviidud, kuid enne pakihaldusoperatsiooni k\u00e4ivitamist. R\u00fcndaja v\u00f5ib saata D-Bus-p\u00e4ringu selle operatsiooni t\u00e4itmiseks, mis on lubatud madala \u00f5igusega kasutajale, seej\u00e4rel saata j\u00e4relep\u00e4ringu. Kui j\u00e4relep\u00e4ring tuleb enne tegeliku lubatud operatsiooni k\u00e4ivitamist, on v\u00f5imalik juba alanud tehingu flaggide \u00fclekirjutamine ja vahem\u00e4lus oleva oleku muutmine. <\/p>\n

Seega t\u00e4idetakse juba alanud lubatud tehing mitte algsete, vaid teises p\u00e4ringus edastatud muudetud parameetritega. Muutes installitava paketi teavet, saab r\u00fcndaja lubatud paketi asemel installida mis tahes teise paketi, sealhulgas kohalikult salvestatud paketi. Paketi installimine toimub root-\u00f5igustega, seega saab r\u00fcndaja s\u00fcsteemis root-juurdep\u00e4\u00e4su, lisades paketti enda scriptleti, mis k\u00e4ivitatakse automaatselt enne v\u00f5i p\u00e4rast installimist.

\"PackageKitis<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 PackageKit, D-Bus-\u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0435, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Pack2TheRoot (CVE-2026-41651), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0438\u043b\u0438 \u0443\u0434\u0430\u043b\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 1.0.2 (2014 \u0433\u043e\u0434) \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 PackageKit 1.3.5. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Deutsche Telekom \u043f\u0440 \u043f\u043e\u043c\u043e\u0449\u0438 AI-\u043c\u043e\u0434\u0435\u043b\u0438 Claude Opus. \u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":169877,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-169876","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PackageKiti haavatavus, mis v\u00f5imaldab saada root-\u00f5igusi erinevates Linuxi jaotustes | ProHoster","description":"PackageKitis, D-Bus-i vahekihil, mis \u00fchtlustab paketihaldusoperatsioone, on avastatud Pack2TheRoot (CVE-2026-41651) haavatavus, mis v\u00f5imaldab mitteprivileegitud kasutajal installida v\u00f5i eemaldada suvalist paketti.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-packagekit-pozvolyayushhaya-poluchit-prava-root-v-raznyh-distributivah-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 PackageKit, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux | ProHoster","og:description":"\u0412 PackageKit, D-Bus-\u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0435, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Pack2TheRoot (CVE-2026-41651), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0438\u043b\u0438 \u0443\u0434\u0430\u043b\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 \u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-packagekit-pozvolyayushhaya-poluchit-prava-root-v-raznyh-distributivah-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-04-24T10:24:33+00:00","article:modified_time":"2026-04-24T10:24:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/169876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=169876"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/169876\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/169877"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=169876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=169876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=169876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}