CVE-2020-16122: 
Linux Debian vulnerability analysis and mitigation

PackageKit's apt backend (CVE-2020-16122) contained a vulnerability where it incorrectly treated all local deb packages as trusted. The vulnerability was discovered in 2020 and affected the apt security model, which is based on repository trust rather than individual file contents (CVE List).

The vulnerability stemmed from the packagekit daemon assuming that packages could be trusted themselves, requiring backends without trust information in packages to explicitly reject local packages as untrusted. The apt backend failed to properly implement this check, allowing local package installations to trigger the 'org.freedesktop.packagekit.package-install' action instead of the required 'org.freedesktop.packagekit.package-install-untrusted' action (Ubuntu Bug).

On systems with configured PolicyKit rules, this vulnerability could allow users to install malicious packages, potentially leading to arbitrary code execution and system compromise. The issue effectively granted users the ability to place arbitrary files in the filesystem and execute arbitrary code as root, despite policies intended to restrict such actions (CVE List).

The vulnerability could be exploited by local users who had permission to install trusted packages. Using the 'pkcon install-local' command with a malicious package would bypass the intended security checks, allowing installation of untrusted packages without proper authorization (Ubuntu Bug).

The issue was addressed through security updates in multiple Ubuntu versions: Ubuntu 20.04 (packagekit 1.1.13-2ubuntu1.1), Ubuntu 18.04 (packagekit 1.1.9-1ubuntu2.18.04.6), and Ubuntu 16.04 (packagekit 0.8.17-4ubuntu6~gcc5.4ubuntu1.5). The fix involved implementing proper trust verification for local packages in the apt backend (Ubuntu Notice).