CVE-2025-3931: Yggdrasil DBus Privilege Escalation Flaw

CVE-2025-3931 Overview

CVE-2025-3931 is a local privilege escalation vulnerability in Yggdrasil, a system broker that relays messages between processes and child worker processes through DBus. Yggdrasil exposes a DBus method to dispatch messages to workers but omits authentication and authorization checks. Any unprivileged local user can invoke the method and reach a package manager worker that can add repositories and install or remove RPM packages. An attacker abuses this to install arbitrary packages and escalate to root, exposing sensitive system data. The weakness is tracked as [CWE-280] Improper Handling of Insufficient Permissions or Privileges.

Critical Impact
Any local user can force the Yggdrasil package manager worker to install attacker-controlled RPMs, resulting in root privilege escalation.

Affected Products

Yggdrasil system broker (RedHatInsights/yggdrasil)
Red Hat Enterprise Linux distributions shipping the affected yggdrasil package
Systems using Yggdrasil workers with package management capabilities

Discovery Timeline

2025-05-14 - CVE-2025-3931 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3931

Vulnerability Analysis

Yggdrasil acts as a broker between system processes and specialized workers over DBus. The broker registers a dispatch method that forwards messages to a chosen worker. That dispatch endpoint accepts calls from any user on the system bus without verifying the caller's identity or entitlement to the target worker.

One bundled worker functions as a package manager. It exposes operations to create and enable repositories and to install or remove RPM packages. Because the broker does not restrict who can send it work, an unprivileged local user can invoke package-management operations that normally require root.

The result is arbitrary RPM installation from attacker-defined repositories. Installing a crafted package executes maintainer scripts as root during %pre or %post phases, giving the attacker full control of the host and any secrets stored on it.

Root Cause

The DBus dispatch method lacks Polkit or peer-credential checks. Yggdrasil trusts every message on the bus regardless of the sender's UID, mapping [CWE-280] Improper Handling of Insufficient Permissions or Privileges. See the upstream fix in GitHub PR #336 for Yggdrasil.

Attack Vector

Exploitation requires local access with any valid user session. The attacker connects to the system DBus, calls the Yggdrasil dispatch method, and instructs the package manager worker to enable an attacker-controlled repository and install a malicious RPM. No user interaction is required beyond the attacker's own session. Refer to the Red Hat CVE Details CVE-2025-3931 for the vendor's technical writeup.

No verified public proof-of-concept code is available; the exploitation mechanism is described in prose above.

Detection Methods for CVE-2025-3931

Indicators of Compromise

Unexpected entries in /etc/yum.repos.d/ or /etc/dnf/repos.d/ referencing unfamiliar hosts or file:// URLs.
Recent rpm -qa --last output showing package installations initiated outside change windows or from non-administrative sessions.
DBus activity on the system bus targeting Yggdrasil interfaces from non-root UIDs.
New setuid binaries, cron entries, or systemd units created immediately after a package install event.

Detection Strategies

Audit dbus-daemon policy files and Yggdrasil service logs for dispatch calls originating from unprivileged users.
Correlate rpm and dnf transaction history (/var/log/dnf.rpm.log, /var/lib/rpm) with the invoking process tree to spot installs not launched by an administrator.
Enable Linux Audit rules on execve for rpm, dnf, and Yggdrasil worker binaries and alert on non-root parents.

Monitoring Recommendations

Forward journalctl -u yggdrasild and DBus broker logs to a central log platform for retention and search.
Alert on creation or modification of repository configuration files under /etc/yum.repos.d/.
Baseline expected package installation sources and flag deviations from managed channels such as Red Hat Satellite or Insights.

How to Mitigate CVE-2025-3931

Immediate Actions Required

Apply the vendor update from Red Hat Security Errata RHSA-2025:7592 on all systems running Yggdrasil.
Inventory hosts with the yggdrasil package installed and prioritize multi-user or shared systems.
Review recently installed RPMs and enabled repositories on affected hosts for signs of abuse.
Restrict interactive shell access on hosts running Yggdrasil until patches are deployed.

Patch Information

Red Hat has published fixed packages through Red Hat Security Errata RHSA-2025:7592. The upstream code change adding authorization checks to the dispatch path is available in GitHub PR #336 for Yggdrasil. Additional vendor context is tracked in Red Hat Bugzilla Case #2362345.

Workarounds

Stop and mask yggdrasild where the service is not required: systemctl mask --now yggdrasild.
Tighten the DBus policy for the Yggdrasil service so that only the root user can send messages to its bus name until patched packages are installed.
Remove or disable the package manager worker binary on hosts that do not need remote package management through Yggdrasil.

bash

# Example DBus policy hardening for the Yggdrasil service name
# Place in /etc/dbus-1/system.d/yggdrasil-restrict.conf
# <busconfig>
#   <policy context="default">
#     <deny send_destination="com.redhat.Yggdrasil1"/>
#   </policy>
#   <policy user="root">
#     <allow send_destination="com.redhat.Yggdrasil1"/>
#   </policy>
# </busconfig>
sudo systemctl reload dbus
sudo systemctl mask --now yggdrasild