CVE-2024-1929

CVE-2024-1929 is a local root exploit affecting dnf5daemon-server versions prior to 5.1.17, allowing an unprivileged local attacker to achieve root access and compromise confidentiality and integrity. The vulnerability stems from insufficient sanity checking of configuration overrides passed via the D-Bus interface, specifically the "config" key in the open_session method. This allows an attacker to load a malicious plugin shared library, leading to arbitrary code execution with root privileges. Rated 8.4 HIGH on the CVSS scale, it requires local access but no user interaction, making it a significant threat to affected systems. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.