CVE-2022-0987

LOW

PackageKit - Information Disclosure via Transaction Interface File Existence Timing

Title source: llm

Description

A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists.

References (1)

Core 1

Core References

Issue Tracking, Third Party Advisory x_refsource_misc

https://bugzilla.redhat.com/show_bug.cgi?id=2064315

Scores

CVSS v3 3.3

EPSS 0.0011

EPSS Percentile 29.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (2)

packagekit_project/packagekit

redhat/enterprise_linux 9.0

Published Jun 28, 2022

Tracked Since Feb 18, 2026