Hard-link package replacement in Debian and Ubuntu APT enables root code execution

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration

The record marks the default status as unaffected, while the described attack requires a non-zero Acquire::Retries setting. Supported affected apt branches are:

• Debian APT: from 0 to before 1.2.36; from 1.4.0 to before 1.4.12; from 1.6.0 to before 1.6.19; from 1.8.0 to before 1.8.2.4; from 1.8.3 through 1.8.5; from 2.0.0 to before 2.0.12; from 2.2.0 to before 2.2.5; from 2.4.0 to before 2.4.15; from 2.6.0 to before 2.6.2; from 2.8.0 to before 2.8.4; from 3.0.0 to before 3.0.4; from 3.2.0 to before 3.2.1; and from 3.3.0 to before 3.3.6.
• Ubuntu APT: from 0 to before 1.0.1ubuntu2.24+esm4; from 1.2.0 to before 1.2.36+esm1; from 1.6.0 to before 1.6.19+esm1; from 2.0.0 to before 2.0.12+esm1; from 2.4.0 to before 2.4.15ubuntu0.1; from 2.8.0 to before 2.8.4ubuntu0.1; from 3.2.0 to before 3.2.1ubuntu0.1; and from 3.3.0 to before 3.3.3ubuntu0.1.
• Debian advisories separately confirm a fix at apt 2.6.2 for Debian 12 bookworm and at apt 3.0.4 for stable trixie. Because the normalized record also marks a 3.3.0 to before 3.3.6 branch as affected, 3.0.4 must not be treated as a universal fix for every Debian branch.
• The Ubuntu status page reviewed for this record lists apt as vulnerable on releases 26.10, 26.04, 24.04, 22.04, 20.04, 18.04, 16.04, and 14.04. The record does not provide a separate fixed package boundary for 26.10.

The flaw is in APT handling of HTTP package downloads when a redirect causes two different downloads to resolve to the same URI. Reuse of hard links and unsafe handling while resuming a download allow an on-path attacker to replace package contents after verification. The required conditions are a package installation that triggers a download, client-side redirect following, a retry of the package-file download, and a non-zero Acquire::Retries setting. At a high level: (1) the attacker manipulates HTTP traffic between the APT client and archive server; (2) different downloads are redirected to the same URI; (3) resume handling and hard-link reuse cause unsafe file reuse; and (4) the attacker-controlled package is installed with root privileges. The record identifies CWE-62 and CWE-367, but does not provide a more specific internal function or implementation path.

The vulnerability is remotely reachable by an on-path attacker who can modify HTTP traffic, including through a malicious mirror or proxy. The record does not require attacker authentication and describes passive user interaction because the victim only needs to perform a qualifying package installation. Exploitation also depends on redirect following, package-download retry behavior, and a non-zero Acquire::Retries setting. The supplied record does not document confirmed exploitation, a public exploit, or ransomware use.

The technical outcome is installation of an attacker-controlled package followed by arbitrary code execution with root privileges. Because the code runs on the affected host, realistic consequences include host-level control, access to local data, unauthorized software or configuration changes, and service disruption. The vulnerability therefore threatens the confidentiality, integrity, and availability of the vulnerable system. Redirect, retry, and traffic-manipulation requirements limit reachability, but do not reduce the consequence when those conditions are present. The record does not establish impact on separate systems or evidence that a compromise occurred.

A successful attack can cause a host to install attacker-controlled code with root privileges. This can expose local data, permit unauthorized changes to software or system configuration, and disrupt services because the resulting code runs with administrative authority. Exposure is concentrated in systems that install packages over an HTTP path that an attacker can manipulate, rather than in every use of APT. The record provides no evidence of a specific breach, victim, or affected dataset.

1. Update apt to the appropriate release-branch boundary. The non-affected boundaries recorded for Debian are 1.2.36, 1.4.12, 1.6.19, 1.8.2.4, 2.0.12, 2.2.5, 2.4.15, 2.6.2, 2.8.4, 3.0.4, 3.2.1, and 3.3.6 for their respective branches.
2. For Ubuntu, update to the corresponding recorded package boundaries: 1.0.1ubuntu2.24+esm4, 1.2.36+esm1, 1.6.19+esm1, 2.0.12+esm1, 2.4.15ubuntu0.1, 2.8.4ubuntu0.1, 3.2.1ubuntu0.1, and 3.3.3ubuntu0.1, according to the installed branch.
3. For Debian 12 bookworm, use apt 2.6.2. For stable trixie, the Debian advisory confirms apt 3.0.4 as fixed. Do not apply the trixie boundary to other Debian branches without checking the package status for that branch.
4. The Debian branch from 1.8.3 through 1.8.5 is marked affected, but the record does not state the exact corrected package boundary immediately after that branch. Use a vendor-provided package outside the affected range and verify the distribution advisory for the installed release.
5. If patching cannot be completed immediately, review whether setting Acquire::Retries to zero is operationally acceptable. This only addresses a prerequisite described by the source, is an inference-based temporary mitigation, and does not replace the security update.

1. Inventory apt versions on Debian, Ubuntu, and derivative systems, then compare them with the affected branches in affected_summary.
2. Check the effective Acquire::Retries configuration. A non-zero value is a required condition in the vulnerability description, but a zero value is not a substitute for patching.
3. Identify systems that install packages through HTTP, redirects, mirrors, or proxy intermediaries that could be manipulated.
4. Review APT, mirror, and proxy logs for package-download redirects or retries occurring during installation activity. This is precautionary review, not a confirmed indicator of compromise.
5. Prioritize systems that installed packages while using mirrors or proxies outside the organization’s full control. The absence of matching log entries does not prove that a system is safe.