Pardus Linux Local Privilege Escalation Flaw Allows Silent Root Access

A critical privilege-escalation chain in the pardus-update package (CVSS v3.1 9.3) allows local users to gain root without authentication. The issue combines: (1) a Polkit policy configured with allow_any=yes permitting passwordless privileged actions; (2) a CRLF injection in SystemSettingsWrite.py that lets attackers add attacker-controlled APT source entries; and (3) AutoAptUpgrade.py copying untrusted APT source files into /etc/apt/sources.list.d/, enabling installation of a malicious .deb. A PoC demonstrates installing a package that sets the SUID bit on /bin/bash, yielding an immediate root shell. Recommended mitigations are to require administrator authentication in the Polkit policy, sanitize carriage returns/newlines in input handling, and restrict APT source file paths to trusted directories.