Debian and Ubuntu flaw lets attackers run code as root during package updates

How the flaw works

A flaw in APT, the package manager used by Debian and Ubuntu, lets an attacker who can intercept or modify package downloads swap a legitimate package for a malicious one. According to The Hacker News↗ (opens in a new tab), this code will then run with root privileges, which means the attacker can take full control of the system.

The attack relies on APT's behaviour when a package download fails. From Debian 12 and Ubuntu 22.04 onwards, APT will automatically retry failed downloads. The attacker can force these retries using HTTP redirects or temporary server errors, then deliver their own package in place of the real one. This is possible if the attacker can modify the network traffic between the user's computer and the package server, such as by being on the same network, controlling a proxy, or running a malicious mirror.

Who is affected

The flaw affects Debian 12, Ubuntu 22.04, and newer versions by default, because these releases enable automatic retries. Older versions like Debian 11 and Ubuntu 20.04 are not exposed by default, but may be vulnerable if users or scripts have enabled the retry setting (Acquire::Retries). Distributions based on Debian and Ubuntu may also be affected, though Ubuntu did not name any specific ones.

At the time of reporting, Ubuntu marked all eight of its tracked releases, from 14.04 LTS to 26.10, as vulnerable. Debian's testing branch was also still on a vulnerable version as of November 4.

The response

Debian, Ubuntu, and APT's developers published advisories on November 4. Debian released fixed versions of APT, including for its now-unsupported Debian 11. Ubuntu published new APT builds for four releases in its security archive. Updates for Ubuntu Pro users on 14.04 are also available. Ubuntu rates the flaw as high priority, with a CVSS 4.0 score of 7.7.

None of the advisories describe real-world attacks exploiting the flaw so far. There is no workaround for systems that cannot update yet. The attack is described over HTTP, and it is not clear whether HTTPS-protected package sources are also exposed.

What you should do

Users and administrators should update APT to the latest version as soon as possible. If you are running an older release and have enabled automatic retries, you are at higher risk. Check your configuration for the Acquire::Retries setting and disable it if you cannot update immediately. Avoid using HTTP for package sources when possible, as encrypted HTTPS connections are harder for attackers to intercept, though the advisories do not confirm if HTTPS is safe in this case.