Pardus Linux Vulnerability Allows Silent Local Root Privilege Escalation

A critical vulnerability chain discovered in the pardus-update package, the core update component of Pardus Linux, allows any local unprivileged user to silently escalate to full root privileges without ever being prompted for a password.

The flaw, assigned a CVSS v3.1 score of 9.3 (Critical), was discovered and documented by security researcher Çağrı Eser (0xc4gr1) on March 13, 2026.

Pardus Linux refers to a Debian-based operating system maintained by TÜBİTAK and widely deployed across Turkish government institutions, public schools, and enterprise environments.

The utility leverages PolicyKit (Polkit) to perform privileged operations through Python-based scripts.

Pardus Linux Vulnerability

This is not a single bug but a chain of compounding flaws that together enable complete system compromise.

Polkit Authorization Bypass (CWE-285): The pardus-update Polkit policy file configures three critical actions  aptupdateaction, autoaptupgradeaction, and systemsettingswrite with <allow_any>yes</allow_any>.

This means any user, regardless of session type or privilege level, can invoke privileged Python helper scripts (SystemSettingsWrite.py and AutoAptUpgrade.py) via pkexec without ever being prompted for a password. This alone constitutes a critical authorization bypass.

CRLF Injection into Config File (CWE-93): SystemSettingsWrite.py accepts command-line arguments and writes them to /etc/pardus/pardus-update.conf using Python’s ConfigParser.

While the library sanitizes newline (\n) characters, it does not filter carriage return (\r) characters. An attacker can inject a value like:

123\rcustom_sourcesd_path=/tmp/pwn.list

This causes ConfigParser to interpret the injected portion as a new key-value pair, effectively poisoning the configuration file with an attacker-controlled APT source path.

Untrusted APT Source Path (CWE-426): AutoAptUpgrade.py reads the poisoned config and passes the custom_sourcesd_path value directly to APT’s sources directory (/etc/apt/sources.list.d/) via shutil.copy2() with zero path validation.

The script then executes apt update and apt full-upgrade -yq as root, according to Nullsecurityx, pulling packages from the attacker-controlled repository hosted in world-writable /tmp.

Proof of Concept

The exploit executes in two pkexec commands from an unprivileged shell. The attacker first creates a fake .deb package whose postinst script sets the SUID bit on /bin/bash, hosted in a local /tmp/repo with a trusted=yes flag to bypass GPG verification.

The two-step trigger injects the malicious repo path into the config and then triggers the upgrade process. The result:

uid=1001(hacker) gid=1001(hacker) euid=0(root) egid=0(root)

The vulnerability has severe security implications:

• Confidentiality: Full read access to all files, including /etc/shadow
• Integrity: Ability to overwrite system files, install rootkits, create backdoor accounts
• Availability: Complete, persistent system takeover
• Scope: Changed attacker fully escapes user context into root privilege

Mitigation:

Three targeted fixes are required to break the exploit chain:

• Harden Polkit policy (Critical): Replace yes with auth_admin for all three privileged actions to enforce administrator authentication
• Sanitize CRLF input in SystemSettingsWrite.py (High): Strip \r and \n characters from all external arguments before passing to ConfigParser
• Validate APT source paths in AutoAptUpgrade.py (High): Restrict accepted paths to trusted system directories (e.g., /usr/share/pardus/) and reject any path in world-writable locations

This chain is a textbook example of how individually “minor” misconfigurations compound into a critical exploit.

No race conditions, kernel exploits, or sophisticated techniques were needed; only missing input validation and an overly permissive Polkit policy.

TÜBİTAK and Pardus maintainers should treat remediation as an urgent priority given the distribution’s widespread use in sensitive government and educational environments.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.