Executive brief
qSnapper, a tool used to manage system snapshots on Linux, contains a security flaw in how it verifies user identity. A local attacker could exploit a timing issue to trick the system into granting them administrative (root) privileges. This could allow an unauthorized user to take full control of the computer, access sensitive files, or disrupt system operations.
Technical details
A TOCTOU (Time-of-Check Time-of-Use) vulnerability exists in qSnapper's D-Bus service before version 1.3.3. The `SnapshotOperations::checkAuthorization()` function utilizes Polkit's `UnixProcess` subject, which relies on PIDs for authentication. Because PIDs can be recycled, a local attacker can initiate a request and, through a race condition, ensure that by the time `polkitd` checks the requester's identity, the PID has been reassigned to a privileged process. This allows the attacker to bypass Polkit policies and execute D-Bus methods as root. The issue was resolved in version 1.3.3 by migrating to the race-free `SystemBusName` subject.
Affected products
- presire qSnapper < 1.3.3
Timeline
- 2026-04-09: disclosed: Initial discovery and internal reporting by SUSE security team.
- 2026-05-25: patched: Upstream release 1.3.3 published with fixes.
- 2026-06-22: advisory: CVE-2026-41045 published to NVD.