CVE-2020-16121: 
Linux Debian vulnerability analysis and mitigation

PackageKit, a package management service, was found to contain a security vulnerability where it provided detailed error messages to unprivileged callers. The vulnerability, identified as CVE-2020-16121, was discovered by Vaisha Bernard and disclosed in July 2020. The issue affected Ubuntu Linux 20.04 LTS and other systems using PackageKit (Ubuntu Notice, NVD).

The vulnerability stems from the InstallFiles, GetFilesLocal, and GetDetailsLocal methods of the D-Bus interface to PackageKit accessing given files before checking for authorization. The issue has been assigned a CVSS v3.1 base score of 3.3 (Low) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is categorized under CWE-209 (Generation of Error Message Containing Sensitive Information) (NVD).

This vulnerability allowed non-privileged users to learn the MIME type of any file on the system, including files they would normally not have access to. The exposure of such information could potentially be used by attackers to gather intelligence about the system and its configuration (Launchpad Bug).

The vulnerability could be exploited locally by unprivileged users to determine the presence and MIME type of files on the system. A proof-of-concept exploit was demonstrated using a Python script that could check for the existence and MIME type of root-owned files (Launchpad Bug).

The vulnerability was fixed in PackageKit version 1.1.13-2ubuntu1.1 for Ubuntu 20.04 LTS. The fix involved hiding failures behind a single error message in the pk-transaction.c file. Users are advised to update their systems to the patched version (Ubuntu Notice).