CVE-2025-27512: 
Rust vulnerability analysis and mitigation

CVE-2025-27512 affects Zincati, an auto-update agent for Fedora CoreOS hosts. The vulnerability was discovered in Zincati v0.0.24 and fixed in v0.0.30, with disclosure on March 17, 2025. The issue stems from a logic error in a polkit rule that incorrectly broadens access to system deployment actions, allowing any unprivileged user with system D-Bus socket access to perform system updates and reboots, instead of restricting these actions to the zincati system user only (GitHub Advisory).

The vulnerability involves a logic error in Zincati's polkit rule configuration that governs two critical system actions: org.projectatomic.rpmostree1.deploy for deploying system updates and org.projectatomic.rpmostree1.finalize-deployment for rebooting into deployed updates. The flaw allows unauthorized access to these privileged operations. The vulnerability has been assigned a CVSS v4.0 score of 2.1 (LOW) with the vector string CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U. The issue is classified under CWE-863 (Incorrect Authorization) and CWE-783 (Operator Precedence Logic Error) (NVD).

The vulnerability allows any unprivileged user with access to the system D-Bus socket to deploy older Fedora CoreOS versions, which could potentially contain known vulnerabilities. However, the impact is somewhat limited as rpm-ostree enforces that the selected version must be from the same branch the system is currently on, preventing deployment of attacker-controlled update payloads. The issue primarily affects systems running untrusted workloads with access to the system D-Bus socket (GitHub Advisory).

The vulnerability is fixed in Zincati v0.0.30. For systems unable to upgrade immediately, a workaround is available by adding a custom polkit rule to /etc/polkit-1/rules.d/00-zincati-fix.rules that explicitly denies these actions to non-zincati users. The fix has been included in Fedora CoreOS releases: stable stream version 41.20250302.3.2, testing stream version 41.20250315.2.0, and next stream version 42.20250316.1.0 (GitHub Advisory).