Pardus Linux: Pardus Linux Vulnerability Lets Local Attackers Gain Silent Root Access

Critical Privilege Escalation Flaw in Pardus Linux Exposes Systems to Full Root Compromise

A severe privilege escalation vulnerability chain, tracked as CVE-2026-5140 (CVSS 9.3), has been discovered in Pardus Linux, a Debian-based distribution widely used in Turkish government and educational institutions. The flaw allows local attackers to gain full root access without authentication by chaining three distinct vulnerabilities in the pardus-update utility.

Vulnerability Breakdown

The exploit leverages three weaknesses in the update mechanism:

1. Polkit Authorization Bypass (CWE-285) – Misconfigured Polkit policies permit any user to execute privileged update actions without authentication, enabling root-level execution via pkexec.
2. CRLF Injection in Configuration Handling (CWE-93) – The SystemSettingsWrite.py script fails to sanitize carriage return (\r) characters, allowing attackers to inject malicious entries into /etc/pardus/pardus-update.conf.
3. Untrusted APT Source Path (CWE-426) – The AutoAptUpgrade.py script blindly trusts attacker-controlled configuration values, enabling the installation of malicious packages from arbitrary repositories.

Exploitation & Impact

A proof-of-concept demonstrates how an attacker can:

• Inject a malicious APT repository path into the configuration file.
• Trigger an update to install a package with a post-install script that sets the SUID bit on /bin/bash, granting persistent root access.

The flaw enables full system compromise, including:

• Confidentiality breaches (access to /etc/shadow and sensitive files).
• Integrity violations (modification of system binaries, backdoor installation).
• Availability risks (complete system takeover).

Mitigation & Timeline

Administrators are urged to:

• Harden Polkit policies by replacing allow_any=yes with auth_admin.
• Sanitize input by stripping both \r and \n characters in configuration scripts.
• Validate APT sources to restrict repository paths to trusted directories.

Discovery & Disclosure:

• Discovered: March 13, 2026
• Researcher: Çağrı Eser (0xc4gr1)
• Vulnerability Classes: CWE-285, CWE-93, CWE-426

The incident underscores the risks of misconfigured defaults, inadequate input validation, and improper privilege enforcement in system design. Organizations using Pardus Linux should audit systems and apply patches immediately to prevent exploitation.

Source: https://gbhackers.com/pardus-linux-vulnerability/

Pardus cybersecurity rating report: https://www.rankiteo.com/company/pardus

"id": "PAR1779272890",
"linkid": "pardus",
"type": "Vulnerability",
"date": "3/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': ['Government', 'Education'],
                        'location': 'Turkey',
                        'name': 'Pardus Linux',
                        'type': 'Operating System'}],
 'attack_vector': 'Local',
 'data_breach': {'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Sensitive system files',
                                              '/etc/shadow']},
 'date_detected': '2026-03-13',
 'description': 'A severe privilege escalation vulnerability chain '
                '(CVE-2026-5140, CVSS 9.3) has been discovered in Pardus '
                'Linux, a Debian-based distribution widely used in Turkish '
                'government and educational institutions. The flaw allows '
                'local attackers to gain full root access without '
                'authentication by chaining three distinct vulnerabilities in '
                'the `pardus-update` utility: Polkit authorization bypass, '
                'CRLF injection in configuration handling, and untrusted APT '
                'source path. Exploitation enables full system compromise, '
                'including confidentiality breaches, integrity violations, and '
                'availability risks.',
 'impact': {'data_compromised': ['Confidentiality breaches (access to '
                                 '/etc/shadow and sensitive files)'],
            'operational_impact': 'Full system compromise, backdoor '
                                  'installation, modification of system '
                                  'binaries',
            'systems_affected': 'Pardus Linux systems'},
 'lessons_learned': 'The incident underscores the risks of misconfigured '
                    'defaults, inadequate input validation, and improper '
                    'privilege enforcement in system design.',
 'post_incident_analysis': {'corrective_actions': ['Patch systems',
                                                   'Audit configurations',
                                                   'Enforce stricter input '
                                                   'validation'],
                            'root_causes': ['Misconfigured Polkit policies',
                                            'Inadequate input validation in '
                                            'configuration scripts',
                                            'Improper privilege enforcement',
                                            'Untrusted APT source path']},
 'recommendations': ['Harden Polkit policies by replacing `allow_any=yes` with '
                     '`auth_admin`',
                     'Sanitize input by stripping both `\\r` and `\\n` '
                     'characters in configuration scripts',
                     'Validate APT sources to restrict repository paths to '
                     'trusted directories',
                     'Audit systems and apply patches immediately'],
 'references': [{'source': 'Researcher: Çağrı Eser (0xc4gr1)'}],
 'response': {'containment_measures': ['Harden Polkit policies',
                                       'Sanitize input in configuration '
                                       'scripts',
                                       'Validate APT sources'],
              'remediation_measures': ['Apply patches', 'Audit systems']},
 'title': 'Critical Privilege Escalation Flaw in Pardus Linux Exposes Systems '
          'to Full Root Compromise',
 'type': 'Privilege Escalation',
 'vulnerability_exploited': ['CVE-2026-5140',
                             'CWE-285 (Polkit Authorization Bypass)',
                             'CWE-93 (CRLF Injection)',
                             'CWE-426 (Untrusted APT Source Path)']}