{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-27512", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-02-26T18:11:52.306Z", "datePublished": "2025-03-17T14:46:28.219Z", "dateUpdated": "2025-03-17T15:01:42.057Z"}, "containers": {"cna": {"title": "Zincati allows unprivileged access to rpm-ostree D-Bus `Deploy()` and `FinalizeDeployment()` methods", "problemTypes": [{"descriptions": [{"cweId": "CWE-783", "lang": "en", "description": "CWE-783: Operator Precedence Logic Error", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/coreos/zincati/security/advisories/GHSA-w6fv-6gcc-x825", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coreos/zincati/security/advisories/GHSA-w6fv-6gcc-x825"}, {"name": "https://github.com/coreos/zincati/commit/01d8e89f799e6ba21bdf7dc668abce23bd0d8f78", "tags": ["x_refsource_MISC"], "url": "https://github.com/coreos/zincati/commit/01d8e89f799e6ba21bdf7dc668abce23bd0d8f78"}, {"name": "https://github.com/coreos/zincati/commit/28a43aa2c1edda091ba659677d73c13e6e3ea99d", "tags": ["x_refsource_MISC"], "url": "https://github.com/coreos/zincati/commit/28a43aa2c1edda091ba659677d73c13e6e3ea99d"}, {"name": "https://github.com/coreos/zincati/releases/tag/v0.0.24", "tags": ["x_refsource_MISC"], "url": "https://github.com/coreos/zincati/releases/tag/v0.0.24"}, {"name": "https://github.com/coreos/zincati/releases/tag/v0.0.30", "tags": ["x_refsource_MISC"], "url": "https://github.com/coreos/zincati/releases/tag/v0.0.30"}], "affected": [{"vendor": "coreos", "product": "zincati", "versions": [{"version": ">= 0.0.24, < 0.0.30", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-03-17T14:46:28.219Z"}, "descriptions": [{"lang": "en", "value": "Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actions `org.projectatomic.rpmostree1.deploy` to deploy updates to the system and `org.projectatomic.rpmostree1.finalize-deployment` to reboot the system into the deployed update. Since Zincati v0.0.24, this polkit rule contains a logic error which broadens access of those polkit actions to any unprivileged user rather than just the `zincati` system user. In practice, this means that any unprivileged user with access to the system D-Bus socket is able to deploy older Fedora CoreOS versions (which may have other known vulnerabilities). Note that rpm-ostree enforces that the selected version must be from the same branch the system is currently on so this cannot directly be used to deploy an attacker-controlled update payload. This primarily impacts users running untrusted workloads with access to the system D-Bus socket. Note that in general, untrusted workloads should not be given this access, whether containerized or not. By default, containers do not have access to the system D-Bus socket. The logic error is fixed in Zincati v0.0.30. A workaround is to manually add a following polkit rule, instructions for which are available in the GitHub Security Advisory."}], "source": {"advisory": "GHSA-w6fv-6gcc-x825", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-17T15:01:29.371339Z", "id": "CVE-2025-27512", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T15:01:42.057Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-27512", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-17T15:01:29.371339Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T15:01:36.484Z"}}], "cna": {"title": "Zincati allows unprivileged access to rpm-ostree D-Bus `Deploy()` and `FinalizeDeployment()` methods", "source": {"advisory": "GHSA-w6fv-6gcc-x825", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "coreos", "product": "zincati", "versions": [{"status": "affected", "version": ">= 0.0.24, < 0.0.30"}]}], "references": [{"url": "https://github.com/coreos/zincati/security/advisories/GHSA-w6fv-6gcc-x825", "name": "https://github.com/coreos/zincati/security/advisories/GHSA-w6fv-6gcc-x825", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/coreos/zincati/commit/01d8e89f799e6ba21bdf7dc668abce23bd0d8f78", "name": "https://github.com/coreos/zincati/commit/01d8e89f799e6ba21bdf7dc668abce23bd0d8f78", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coreos/zincati/commit/28a43aa2c1edda091ba659677d73c13e6e3ea99d", "name": "https://github.com/coreos/zincati/commit/28a43aa2c1edda091ba659677d73c13e6e3ea99d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coreos/zincati/releases/tag/v0.0.24", "name": "https://github.com/coreos/zincati/releases/tag/v0.0.24", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coreos/zincati/releases/tag/v0.0.30", "name": "https://github.com/coreos/zincati/releases/tag/v0.0.30", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actions `org.projectatomic.rpmostree1.deploy` to deploy updates to the system and `org.projectatomic.rpmostree1.finalize-deployment` to reboot the system into the deployed update. Since Zincati v0.0.24, this polkit rule contains a logic error which broadens access of those polkit actions to any unprivileged user rather than just the `zincati` system user. In practice, this means that any unprivileged user with access to the system D-Bus socket is able to deploy older Fedora CoreOS versions (which may have other known vulnerabilities). Note that rpm-ostree enforces that the selected version must be from the same branch the system is currently on so this cannot directly be used to deploy an attacker-controlled update payload. This primarily impacts users running untrusted workloads with access to the system D-Bus socket. Note that in general, untrusted workloads should not be given this access, whether containerized or not. By default, containers do not have access to the system D-Bus socket. The logic error is fixed in Zincati v0.0.30. A workaround is to manually add a following polkit rule, instructions for which are available in the GitHub Security Advisory."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-783", "description": "CWE-783: Operator Precedence Logic Error"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-03-17T14:46:28.219Z"}}}, "cveMetadata": {"cveId": "CVE-2025-27512", "state": "PUBLISHED", "dateUpdated": "2025-03-17T15:01:42.057Z", "dateReserved": "2025-02-26T18:11:52.306Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-03-17T14:46:28.219Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actions `org.projectatomic.rpmostree1.deploy` to deploy updates to the system and `org.projectatomic.rpmostree1.finalize-deployment` to reboot the system into the deployed update. Since Zincati v0.0.24, this polkit rule contains a logic error which broadens access of those polkit actions to any unprivileged user rather than just the `zincati` system user. In practice, this means that any unprivileged user with access to the system D-Bus socket is able to deploy older Fedora CoreOS versions (which may have other known vulnerabilities). Note that rpm-ostree enforces that the selected version must be from the same branch the system is currently on so this cannot directly be used to deploy an attacker-controlled update payload. This primarily impacts users running untrusted workloads with access to the system D-Bus socket. Note that in general, untrusted workloads should not be given this access, whether containerized or not. By default, containers do not have access to the system D-Bus socket. The logic error is fixed in Zincati v0.0.30. A workaround is to manually add a following polkit rule, instructions for which are available in the GitHub Security Advisory."}, {"lang": "es", "value": "Zincati es un agente de actualizaci\u00f3n autom\u00e1tica para hosts Fedora CoreOS. Zincati incluye una regla de polkit que permite al usuario del sistema `zincati` usar las acciones `org.projectatomic.rpmostree1.deploy` para implementar actualizaciones en el sistema y `org.projectatomic.rpmostree1.finalize-deployment` para reiniciar el sistema con la actualizaci\u00f3n implementada. Desde Zincati v0.0.24, esta regla de polkit contiene un error l\u00f3gico que ampl\u00eda el acceso a estas acciones de polkit a cualquier usuario sin privilegios, en lugar de solo al usuario del sistema `zincati`. En la pr\u00e1ctica, esto significa que cualquier usuario sin privilegios con acceso al socket D-Bus del sistema puede implementar versiones anteriores de Fedora CoreOS (que pueden tener otras vulnerabilidades conocidas). Tenga en cuenta que rpm-ostree exige que la versi\u00f3n seleccionada sea de la misma rama en la que se encuentra el sistema, por lo que no se puede usar directamente para implementar un payload de actualizaci\u00f3n controlado por un atacante. Esto afecta principalmente a los usuarios que ejecutan cargas de trabajo no confiables con acceso al socket D-Bus del sistema. Tenga en cuenta que, en general, no se debe otorgar este acceso a las cargas de trabajo no confiables, est\u00e9n o no en contenedores. De forma predeterminada, los contenedores no tienen acceso al socket D-Bus del sistema. El error l\u00f3gico se corrigi\u00f3 en Zincati v0.0.30. Un workaround es agregar manualmente la siguiente regla de polkit, cuyas instrucciones est\u00e1n disponibles en GitHub Security Advisory."}], "id": "CVE-2025-27512", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2025-03-17T15:15:44.557", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/coreos/zincati/commit/01d8e89f799e6ba21bdf7dc668abce23bd0d8f78"}, {"source": "security-advisories@github.com", "url": "https://github.com/coreos/zincati/commit/28a43aa2c1edda091ba659677d73c13e6e3ea99d"}, {"source": "security-advisories@github.com", "url": "https://github.com/coreos/zincati/releases/tag/v0.0.24"}, {"source": "security-advisories@github.com", "url": "https://github.com/coreos/zincati/releases/tag/v0.0.30"}, {"source": "security-advisories@github.com", "url": "https://github.com/coreos/zincati/security/advisories/GHSA-w6fv-6gcc-x825"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-783"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}