{"metadata": {"vulnerability": "cve-2025-27512", "count": 16, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 8}}, "data": [{"timestamp": "2025-02-26T18:11:52.306Z", "date_only": false, "value": "2025-02-26T18:11:52.306Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2025-27512", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-03-17T14:46:28.219Z", "date_only": false, "value": "2025-03-17T14:46:28.219Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-27512", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-03-17T14:46:28.219Z", "date_only": false, "value": "2025-03-17T14:46:28.219Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2025-27512", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-17T14:46:56Z", "date_only": false, "value": "2025-03-17T14:46:56Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-W6FV-6GCC-X825", "record": "GHSA-W6FV-6GCC-X825", "field": "published"}, {"timestamp": "2025-03-17T15:01:29.371Z", "date_only": false, "value": "2025-03-17T15:01:29.371339Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-27512", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-03-17T15:01:29.371Z", "date_only": false, "value": "2025-03-17T15:01:29.371339Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-27512", "record": "FKIE_CVE-2025-27512", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-03-17T15:01:42.057Z", "date_only": false, "value": "2025-03-17T15:01:42.057Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2025-27512", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-03-17T15:01:42.057Z", "date_only": false, "value": "2025-03-17T15:01:42.057Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-27512", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-17T15:15:44Z", "date_only": false, "value": "2025-03-17T15:15:44Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-W6FV-6GCC-X825", "record": "GHSA-W6FV-6GCC-X825", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-03-17T15:15:44.557Z", "date_only": false, "value": "2025-03-17T15:15:44.557", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-27512", "record": "FKIE_CVE-2025-27512", "field": "published"}, {"timestamp": "2025-03-17T17:28:05Z", "date_only": false, "value": "2025-03-17T17:28:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cvedetector/20474", "record": "CVE-2025-27512", "field": "creation_timestamp", "uuid": "ecfd86f7-2038-4e3a-ae5a-f7b900041899", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-27512 - Fedora CoreOS Zincati Polkit Privilege Escalation\", \n  \"Content\": \"CVE ID : CVE-2025-27512 \nPublished : March 17, 2025, 3:15 p.m. | 33\u00a0minutes ago \nDescription : Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actions `org.projectatomic.rpmostree1.deploy` to deploy updates to the system and `org.projectatomic.rpmostree1.finalize-deployment` to reboot the system into the deployed update. Since Zincati v0.0.24, this polkit rule contains a logic error which broadens access of those polkit actions to any unprivileged user rather than just the `zincati` system user. In practice, this means that any unprivileged user with access to the system D-Bus socket is able to deploy older Fedora CoreOS versions (which may have other known vulnerabilities). Note that rpm-ostree enforces that the selected version must be from the same branch the system is currently on so this cannot directly be used to deploy an attacker-controlled update payload. This primarily impacts users running untrusted workloads with access to the system D-Bus socket. Note that in general, untrusted workloads should not be given this access, whether containerized or not. By default, containers do not have access to the system D-Bus socket. The logic error is fixed in Zincati v0.0.30. A workaround is to manually add a following polkit rule, instructions for which are available in the GitHub Security Advisory. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"17 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/20474"}, {"timestamp": "2025-03-17T17:45:51.159Z", "date_only": false, "value": "2025-03-17T17:45:51.159376Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lklphu7xkg2j", "record": "CVE-2025-27512", "field": "creation_timestamp", "uuid": "cd702a2a-e7a6-41ee-a28d-417ec45f05c3", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3lklphu7xkg2j"}, {"timestamp": "2025-03-19T15:00:20Z", "date_only": false, "value": "2025-03-19T15:00:20Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-W6FV-6GCC-X825", "record": "GHSA-W6FV-6GCC-X825", "field": "modified"}, {"timestamp": "2025-08-12T13:33:28Z", "date_only": false, "value": "2025-08-12T13:33:28.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/02fb130c-7874-4693-9b66-81ed91a2e996", "record": "CVE-2025-27512", "field": "creation_timestamp", "uuid": "7768a966-b215-4fa7-8271-6d8e2c3f541c"}, {"timestamp": "2025-08-21T03:19:31Z", "date_only": false, "value": "2025-08-21T03:19:31.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/02fb130c-7874-4693-9b66-81ed91a2e996", "record": "CVE-2025-27512", "field": "creation_timestamp", "uuid": "1d8a8501-4b55-4750-869d-04c81dc1685a"}, {"timestamp": "2026-06-17T09:03:44.010Z", "date_only": false, "value": "2026-06-17T09:03:44.010", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-27512", "record": "FKIE_CVE-2025-27512", "field": "lastModified"}]}