CVE-2026-79617: Pardus LightDM Greeter Privilege Escalation

CVE-2026-79617 Overview

CVE-2026-79617 is an incorrect permission assignment vulnerability [CWE-732] in the Pardus LightDM Greeter developed by TÜBİTAK BİLGEM Software Technologies Research Institute. The flaw affects Pardus LightDM Greeter versions before 0.4.15. A local authenticated attacker with low privileges can exploit incorrectly configured access control on critical resources to compromise confidentiality and integrity on affected systems. The vulnerability does not require user interaction and can be triggered from a local session.

Critical Impact

A low-privileged local user can access or modify critical resources managed by the LightDM greeter, undermining login-screen isolation on Pardus Linux workstations.

Affected Products

• TÜBİTAK BİLGEM Pardus LightDM Greeter versions before 0.4.15
• Pardus Linux distributions bundling the vulnerable greeter component
• Systems using the Pardus LightDM Greeter as the display manager front-end

Discovery Timeline

• 2026-09-09 - CVE-2026-79617 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79617

Vulnerability Analysis

The Pardus LightDM Greeter is the graphical login front-end used with the LightDM display manager on Pardus Linux systems. The vulnerability arises from incorrect permission assignment on resources that the greeter relies on during authentication and session initialization. Because these resources are not restricted to privileged accounts, a local user with an existing low-privilege session can read or modify them. The attack is local and requires low privileges, but no user interaction, which allows scripted exploitation once a foothold exists on the host.

Root Cause

The root cause is classified as [CWE-732] Incorrect Permission Assignment for Critical Resource. Files, directories, or interprocess communication endpoints used by the greeter are created or maintained with permissions broader than required. This breaks the trust boundary between unprivileged users and the greeter process, which typically runs with elevated privileges during display and authentication handling.

Attack Vector

Exploitation requires local access with an authenticated low-privileged account. An attacker leverages the permissive access control to read sensitive greeter state or tamper with configuration and runtime data. Successful exploitation results in high impact to confidentiality and integrity, while availability is not affected. Refer to the Siber Güvenlik Notification TR-26-1051 for vendor-coordinated details.

No verified proof-of-concept code has been published for CVE-2026-79617. The vulnerability mechanism centers on abusing over-permissive file or IPC access controls used by the LightDM greeter binary during graphical login handling.

Detection Methods for CVE-2026-79617

Indicators of Compromise

• Unexpected read or write access by unprivileged users to files or sockets owned by the LightDM greeter process.
• Modifications to greeter configuration files or theme assets outside of package management operations.
• Anomalous local process activity spawned in the context of the greeter or display manager service.

Detection Strategies

• Audit filesystem permissions on greeter-related paths under /etc/lightdm/ and any Pardus-specific greeter directories, flagging world-writable or group-writable critical resources.
• Enable Linux auditd rules to record open, chmod, and chown syscalls targeting LightDM greeter files by non-root UIDs.
• Compare installed pardus-lightdm-greeter package versions across the fleet against the fixed version 0.4.15 or later.

Monitoring Recommendations

• Forward auditd and package inventory telemetry to a centralized analytics pipeline for cross-host correlation.
• Alert on privilege boundary violations where a low-privileged user interacts with resources belonging to the display manager.
• Track post-login local activity for behaviors consistent with local privilege escalation attempts against display components.

How to Mitigate CVE-2026-79617

Immediate Actions Required

• Upgrade pardus-lightdm-greeter to version 0.4.15 or later using the Pardus package management tooling.
• Inventory all Pardus endpoints and identify hosts still running affected greeter versions.
• Restrict local shell and remote interactive access on multi-user Pardus systems until patches are deployed.

Patch Information

The vendor advisory published as Siber Güvenlik Notification TR-26-1051 identifies 0.4.15 as the fixed release. Administrators should apply distribution updates that ship the corrected greeter package and verify permission changes on greeter-managed resources after the update.

Workarounds

• Manually tighten permissions on LightDM greeter configuration files and runtime directories so that only root and the display manager user can read or modify them.
• Reduce the number of local user accounts on affected hosts, especially on shared or kiosk-style workstations.
• Consider substituting an alternative greeter on non-standard deployments until the patched version can be installed.

# Verify installed greeter version and inspect critical permissions
dpkg -s pardus-lightdm-greeter | grep -i version
find /etc/lightdm -type f -perm /o+w -ls
find /etc/lightdm -type d -perm /o+w -ls