Use-after-free in PackageKit - CVE-2024-0217

Vulnerability identifier: #VU87936

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-0217

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in pk-transaction.c. A local user can trigger a use-after-free error and crash the application.

PackageKit
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Desktop Applications Module
openSUSE Leap
libyui-rest-api-debugsource
libyui-rest-api11-debuginfo
libyui-rest-api11
libyui-rest-api-devel
PackageKit-backend-zypp
PackageKit-lang
libpackagekit-glib2-18-debuginfo
PackageKit-debugsource
PackageKit-debuginfo
typelib-1_0-PackageKitGlib-1_0
PackageKit
PackageKit-devel-debuginfo
PackageKit-backend-zypp-debuginfo
libpackagekit-glib2-devel
PackageKit-devel
libpackagekit-glib2-18
libpackagekit-glib2-devel-64bit
libpackagekit-glib2-18-64bit
libpackagekit-glib2-18-64bit-debuginfo
libpackagekit-glib2-devel-32bit
libpackagekit-glib2-18-32bit
PackageKit-gstreamer-plugin-debuginfo
PackageKit-backend-dnf-debuginfo
PackageKit-gtk3-module-debuginfo
PackageKit-gtk3-module
PackageKit-backend-dnf
PackageKit-gstreamer-plugin
PackageKit-branding-upstream
libpackagekit-glib2-18-32bit-debuginfo
zypper-debuginfo
zypper-debugsource
zypper
zypper-needs-restarting
zypper-log
libyui-qt-pkg11-debuginfo
libyui-qt-pkg-debugsource
libyui-qt-pkg-devel
libyui-qt-pkg11
libyui-ncurses-pkg-debugsource
libyui-ncurses-pkg-devel
libyui-ncurses-pkg11-debuginfo
libyui-ncurses-pkg11
libyui-debugsource
libyui-devel
libyui11
libyui11-debuginfo
libyui-qt-rest-api-debugsource
libyui-qt-debugsource
libyui-qt-rest-api15
libyui-ncurses-devel
libyui-qt-graph15
libyui-qt-devel
libyui-rest-api15
libyui-qt-graph-devel
perl-yui-debuginfo
libyui-ncurses-rest-api15-debuginfo
libyui-qt-graph-debugsource
ruby-yui
libyui-rest-api15-debuginfo
python3-yui-debuginfo
libyui-ncurses15
ruby-yui-debuginfo
libyui-ncurses-rest-api-devel
libyui-qt-graph15-debuginfo
libyui-bindings-debugsource
libyui15
libyui-qt15-debuginfo
libyui15-debuginfo
perl-yui
libyui-bindings-debuginfo
libyui-ncurses-rest-api15
libyui-qt-rest-api-devel
libyui-qt-rest-api15-debuginfo
libyui-ncurses-rest-api-debugsource
libyui-ncurses-debugsource
libyui-ncurses-tools
libyui-qt15
python3-yui
libyui-ncurses15-debuginfo
libyui-qt-pkg15
libyui-qt-pkg15-debuginfo
libyui-ncurses-pkg15-debuginfo
libyui-ncurses-pkg15
yast2-pkg-bindings-debugsource
yast2-pkg-bindings
yast2-pkg-bindings-debuginfo
PackageKit-branding-SLE
libzypp-debugsource
libzypp
libzypp-debuginfo
libzypp-devel

Install updates from vendor's website.

PackageKit - update to 1.2.7
libyui-rest-api-debugsource - addressed in versions 0.3.0-150200.3.2.2, 4.1.5-150300.3.10.5
libyui-rest-api11-debuginfo - update to 0.3.0-150200.3.2.2
libyui-rest-api11 - update to 0.3.0-150200.3.2.2
libyui-rest-api-devel - addressed in versions 0.3.0-150200.3.2.2, 4.1.5-150300.3.10.5
PackageKit-backend-zypp - addressed in versions 1.1.13-150200.4.30.4, 1.2.4-150400.3.13.1
PackageKit-lang - addressed in versions 1.1.13-150200.4.30.4, 1.2.4-150400.3.13.1
libpackagekit-glib2-18-debuginfo - addressed in versions 1.1.13-150200.4.30.4, 1.2.4-150400.3.13.1
PackageKit-debugsource - addressed in versions 1.1.13-150200.4.30.4, 1.2.4-150400.3.13.1
PackageKit-debuginfo - addressed in versions 1.1.13-150200.4.30.4, 1.2.4-150400.3.13.1
typelib-1_0-PackageKitGlib-1_0 - addressed in versions 1.1.13-150200.4.30.4, 1.2.4-150400.3.13.1
PackageKit - addressed in versions 1.1.13-150200.4.30.4, 1.2.4-150400.3.13.1
PackageKit-devel-debuginfo - addressed in versions 1.1.13-150200.4.30.4, 1.2.4-150400.3.13.1
PackageKit-backend-zypp-debuginfo - addressed in versions 1.1.13-150200.4.30.4, 1.2.4-150400.3.13.1
libpackagekit-glib2-devel - addressed in versions 1.1.13-150200.4.30.4, 1.2.4-150400.3.13.1
PackageKit-devel - addressed in versions 1.1.13-150200.4.30.4, 1.2.4-150400.3.13.1
libpackagekit-glib2-18 - addressed in versions 1.1.13-150200.4.30.4, 1.2.4-150400.3.13.1
libpackagekit-glib2-devel-64bit - update to 1.2.4-150400.3.13.1
libpackagekit-glib2-18-64bit - update to 1.2.4-150400.3.13.1
libpackagekit-glib2-18-64bit-debuginfo - update to 1.2.4-150400.3.13.1
libpackagekit-glib2-devel-32bit - update to 1.2.4-150400.3.13.1
libpackagekit-glib2-18-32bit - update to 1.2.4-150400.3.13.1
PackageKit-gstreamer-plugin-debuginfo - update to 1.2.4-150400.3.13.1
PackageKit-backend-dnf-debuginfo - update to 1.2.4-150400.3.13.1
PackageKit-gtk3-module-debuginfo - update to 1.2.4-150400.3.13.1
PackageKit-gtk3-module - update to 1.2.4-150400.3.13.1
PackageKit-backend-dnf - update to 1.2.4-150400.3.13.1
PackageKit-gstreamer-plugin - update to 1.2.4-150400.3.13.1
PackageKit-branding-upstream - update to 1.2.4-150400.3.13.1
libpackagekit-glib2-18-32bit-debuginfo - update to 1.2.4-150400.3.13.1
zypper-debuginfo - update to 1.14.69-150200.73.7
zypper-debugsource - update to 1.14.69-150200.73.7
zypper - update to 1.14.69-150200.73.7
zypper-needs-restarting - update to 1.14.69-150200.73.7
zypper-log - update to 1.14.69-150200.73.7
libyui-qt-pkg11-debuginfo - update to 2.47.5-150200.3.4.4
libyui-qt-pkg-debugsource - addressed in versions 2.47.5-150200.3.4.4, 4.1.5-150300.3.10.17
libyui-qt-pkg-devel - addressed in versions 2.47.5-150200.3.4.4, 4.1.5-150300.3.10.17
libyui-qt-pkg11 - update to 2.47.5-150200.3.4.4
libyui-ncurses-pkg-debugsource - addressed in versions 2.50.8-150200.3.5.5, 4.1.5-150300.3.10.19
libyui-ncurses-pkg-devel - addressed in versions 2.50.8-150200.3.5.5, 4.1.5-150300.3.10.19
libyui-ncurses-pkg11-debuginfo - update to 2.50.8-150200.3.5.5
libyui-ncurses-pkg11 - update to 2.50.8-150200.3.5.5
libyui-debugsource - addressed in versions 3.9.3-150200.3.2.6, 4.1.5-150300.3.10.5
libyui-devel - addressed in versions 3.9.3-150200.3.2.6, 4.1.5-150300.3.10.5
libyui11 - update to 3.9.3-150200.3.2.6
libyui11-debuginfo - update to 3.9.3-150200.3.2.6
libyui-qt-rest-api-debugsource - update to 4.1.5-150300.3.10.5
libyui-qt-debugsource - update to 4.1.5-150300.3.10.5
libyui-qt-rest-api15 - update to 4.1.5-150300.3.10.5
libyui-ncurses-devel - update to 4.1.5-150300.3.10.5
libyui-qt-graph15 - update to 4.1.5-150300.3.10.5
libyui-qt-devel - update to 4.1.5-150300.3.10.5
libyui-rest-api15 - update to 4.1.5-150300.3.10.5
libyui-qt-graph-devel - update to 4.1.5-150300.3.10.5
perl-yui-debuginfo - update to 4.1.5-150300.3.10.5
libyui-ncurses-rest-api15-debuginfo - update to 4.1.5-150300.3.10.5
libyui-qt-graph-debugsource - update to 4.1.5-150300.3.10.5
ruby-yui - update to 4.1.5-150300.3.10.5
libyui-rest-api15-debuginfo - update to 4.1.5-150300.3.10.5
python3-yui-debuginfo - update to 4.1.5-150300.3.10.5
libyui-ncurses15 - update to 4.1.5-150300.3.10.5
ruby-yui-debuginfo - update to 4.1.5-150300.3.10.5
libyui-ncurses-rest-api-devel - update to 4.1.5-150300.3.10.5
libyui-qt-graph15-debuginfo - update to 4.1.5-150300.3.10.5
libyui-bindings-debugsource - update to 4.1.5-150300.3.10.5
libyui15 - update to 4.1.5-150300.3.10.5
libyui-qt15-debuginfo - update to 4.1.5-150300.3.10.5
libyui15-debuginfo - update to 4.1.5-150300.3.10.5
perl-yui - update to 4.1.5-150300.3.10.5
libyui-bindings-debuginfo - update to 4.1.5-150300.3.10.5
libyui-ncurses-rest-api15 - update to 4.1.5-150300.3.10.5
libyui-qt-rest-api-devel - update to 4.1.5-150300.3.10.5
libyui-qt-rest-api15-debuginfo - update to 4.1.5-150300.3.10.5
libyui-ncurses-rest-api-debugsource - update to 4.1.5-150300.3.10.5
libyui-ncurses-debugsource - update to 4.1.5-150300.3.10.5
libyui-ncurses-tools - update to 4.1.5-150300.3.10.5
libyui-qt15 - update to 4.1.5-150300.3.10.5
python3-yui - update to 4.1.5-150300.3.10.5
libyui-ncurses15-debuginfo - update to 4.1.5-150300.3.10.5
libyui-qt-pkg15 - update to 4.1.5-150300.3.10.17
libyui-qt-pkg15-debuginfo - update to 4.1.5-150300.3.10.17
libyui-ncurses-pkg15-debuginfo - update to 4.1.5-150300.3.10.19
libyui-ncurses-pkg15 - update to 4.1.5-150300.3.10.19
yast2-pkg-bindings-debugsource - addressed in versions 4.2.17-150200.3.24.6, 4.3.13-150300.3.8.21
yast2-pkg-bindings - addressed in versions 4.2.17-150200.3.24.6, 4.3.13-150300.3.8.21
yast2-pkg-bindings-debuginfo - addressed in versions 4.2.17-150200.3.24.6, 4.3.13-150300.3.8.21
PackageKit-branding-SLE - update to 12.0-150200.9.2.2
libzypp-debugsource - update to 17.32.2-150200.92.3
libzypp - update to 17.32.2-150200.92.3
libzypp-debuginfo - update to 17.32.2-150200.92.3
libzypp-devel - update to 17.32.2-150200.92.3

• https://access.redhat.com/security/cve/CVE-2024-0217
• https://bugzilla.redhat.com/show_bug.cgi?id=2256624
• https://github.com/PackageKit/PackageKit/commit/64278c9127e3333342b56ead99556161f7e86f79

• Denial of service in PackageKit
• SUSE update for PackageKit
• SUSE update for Recommended update for libzypp, zypper, PackageKit