Debian, Ubuntu patch APT flaw that could hand attackers root

Publisher excerpt From CSO Online

Linux administrators’ trust in package managers is being tested by a newly disclosed vulnerability in APT, the package management system used by Debian, Ubuntu, and their derivatives, that could allow attackers to install unverified software with root privileges. Tracked as CVE-2026-109518, the vulnerability could let an attacker positioned to manipulate HTTP traffic between an APT client and an archive server install an attacker-controlled package without verification. Debian disclosed the flaw on November 4, crediting security researcher Max Justicz. Ubuntu subsequently rated it High, assigning it a CVSS score of 7.7. “I used an AI for two hours and found a zero-day that would let a nation-state hack any server running stock Ubuntu,” Justicz said in an X post. Successful exploitation could allow arbitrary code execution with root privileges on a vulnerable machine. Both distributions have issued fixes. Redirects and retries turn hardlinks into an attack surface The problem lies in APT’s handling of HTTP redirects and resumed downloads. “APT can merge two different package downloads after an HTTP redirect gives them the same URI,” Debian’s advisory said. “Improper file handling when resuming an HTTP download allows a man-in-the-middle (MitM) attacker to replace a package after verification, resulting in the execution of arbitrary code as root.” APT developers provide a more detailed explanation: an attacker can exploit redirects and transient HTTP server errors that trigger download retries, causing APT to override existing hard links with a chosen payload. Because Debian packages are installed with root privileges, successfully substituting a package can lead to arbitrary code execution as root. Ubuntu described the required attack position as an on-path attacker able to manipulate traffic between the package client and the archive server. A malicious mirror or proxy could provide that position, but the attack requires specific download conditions. Retry settings decide who is exposed The vulnerability depends on APT’s Acquire::Retries setting being non-zero. APT developers say this has been the default since version 2.3.2, although scripts may have enabled retries on older installations. Ubuntu specifies that the default retry value of three applies from Debian 12 (Bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish) onward. Older releases are not exposed by default, but may still be vulnerable if retries have been enabled. Debian 13 (Trixie) is patched in APT 3.0.4, while Debian 12 (Bookworm) received the fix in version 2.6.2. Ubuntu has also released patched packages for supported releases, including 22.04 LTS, 24.04.LTS, and 26.04 LTS. Ubuntu 26.10 was also affected, with its fix being published when Ubuntu’s November 4 advisory appeared. The fix addresses the underlying file-handling issue. In a commit authored on October 12, APT developer Julian Andres Klode changed the download code to open destination files exclusively, unlinki…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.