Critical Privilege Escalation Flaw in Pardus Linux Exposes Systems to Full Root Compromise A severe privilege escalation vulnerability chain, tracked as CVE-2026-5140 (CVSS 9.3), has been discovered in Pardus Linux, a Debian-based distribution widely used in Turkish government and educational institutions. The flaw allows local attackers to gain full root access without authentication by chaining three distinct vulnerabilities in the `pardus-update` utility. ### Vulnerability Breakdown The exploit leverages three weaknesses in the update mechanism: 1. Polkit Authorization Bypass (CWE-285) – Misconfigured Polkit policies permit any user to execute privileged update actions without authentication, enabling root-level execution via `pkexec`. 2. CRLF Injection in Configuration Handling (CWE-93) – The `SystemSettingsWrite.py` script fails to sanitize carriage return (`\r`) characters, allowing attackers to inject malicious entries into `/etc/pardus/pardus-update.conf`. 3. Untrusted APT Source Path (CWE-426) – The `AutoAptUpgrade.py` script blindly trusts attacker-controlled configuration values, enabling the installation of malicious packages from arbitrary repositories. ### Exploitation & Impact A proof-of-concept demonstrates how an attacker can: - Inject a malicious APT repository path into the configuration file. - Trigger an update to install a package with a post-install script that sets the SUID bit on `/bin/bash`, granting persistent root access. The flaw enables full system compromise, including: - Confidentiality breaches (access to `/etc/shadow` and sensitive files). - Integrity violations (modification of system binaries, backdoor installation). - Availability risks (complete system takeover). ### Mitigation & Timeline Administrators are urged to: - Harden Polkit policies by replacing `allow_any=yes` with `auth_admin`. - Sanitize input by stripping both `\r` and `\n` characters in configuration scripts. - Validate APT sources to restrict repository paths to trusted directories. Discovery & Disclosure: - Discovered: March 13, 2026 - Researcher: Çağrı Eser (0xc4gr1) - Vulnerability Classes: CWE-285, CWE-93, CWE-426 The incident underscores the risks of misconfigured defaults, inadequate input validation, and improper privilege enforcement in system design. Organizations using Pardus Linux should audit systems and apply patches immediately to prevent exploitation.