## Impact
Zincati ships a polkit rule which allows the `zincati` system user to use
the following actions:
- `org.projectatomic.rpmostree1.deploy`: used to deploy updates to the
system
- `org.projectatomic.rpmostree1.finalize-deployment`: used to reboot the
system into the deployed update
Since Zincati [v0.0.24], this polkit rule contains a logic error which
broadens access of those polkit actions to any unprivileged user rather
than just the `zincati` system user.
In practice, this means that any unprivileged user with access to the
system D-Bus socket is able to deploy older Fedora CoreOS versions (which
may have other known vulnerabilities). Note that rpm-ostree enforces that
the selected version must be from the same branch the system is currently
on so this cannot directly be used to deploy an attacker-controlled update
payload.
This primarily impacts users running untrusted workloads with access to the
system D-Bus socket. Note that in general, untrusted workloads should not
be given this access, whether containerized or not. By default, containers
do not have access to the system D-Bus socket.
## Patches
The logic error is fixed in Zincati [v0.0.30].
Fedora CoreOS releases containing the fix:
- on the `stable` stream: 41.20250302.3.2
- on the `testing` stream: 41.20250315.2.0
- on the `next` stream: 42.20250316.1.0
## Workarounds
See the GitHub Advisory for details:
https://github.com/coreos/zincati/security/advisories/GHSA-w6fv-6gcc-x825
## References
This issue was introduced by [commit 28a43aa2], and is fixed in [v0.0.30].
[v0.0.24]: https://github.com/coreos/zincati/releases/tag/v0.0.24
[v0.0.30]: https://github.com/coreos/zincati/releases/tag/v0.0.30
[commit 28a43aa2]:
https://github.com/coreos/zincati/commit/28a43aa2c1edda091ba659677d73c13e6e…
--
Timothée Ravier
CoreOS co-Team Lead
Red Hat <https://www.redhat.com/>
travier(a)redhat.com
<https://www.redhat.com/>