CVE-2024-1929 is a high severity (CVSS 7.5) local privilege escalation in dnf5daemon-server, part of the dnf5 package manager. A D-Bus method accepts unchecked configuration values. The NVD record says versions before 5.1.17 are affected. Update dnf5, or remove dnf5daemon-server if you do not use it.
What's affected
The NVD record says dnf5daemon-server before 5.1.17 is affected. The write up I read, a post on the oss-security list from a SUSE security reviewer, says the reviewed version was 5.1.9, that the issue was also seen on Fedora 39 with 5.1.10, and that a whitelist for configuration keys was implemented upstream. It does not state a release number for the fix, so the 5.1.17 figure comes from NVD alone. Confirm it in your distribution's advisory.
The only precondition named is that the dnf5daemon-server package is installed. NVD scores it 7.5 (High) with a local attack vector, vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. The same report covers a second issue, CVE-2024-1930, about session limits and session closing.
How to check if you're exposed
Run rpm -q dnf5daemon-server on RPM based systems. If the package is not installed, this flaw does not apply. If it is, compare the version with 5.1.17 and read your distribution's security advisory, since backports may keep an older version number.
You can also list D-Bus system services to see whether dnf5daemon-server is registered, and check whether it is enabled. Most servers do not need this component, since it exists to give other programs a D-Bus interface to the package manager.
What to do now
- List hosts with dnf5daemon-server installed.
- Update dnf5 to a build that includes the fix, and confirm with your distribution advisory.
- Remove dnf5daemon-server where no application needs it.
- Limit local shell access on systems that must keep the older package until patched.
- Add the check to your host baseline so the package does not come back unnoticed.
Why it matters
NVD classifies this as CWE-20, improper input validation. The D-Bus method that opens a session takes a map of configuration entries, and a nested map was forwarded to the package library as configuration overrides without checking what it contained. Because the service runs as root, whatever the library was told to load or do happened with root rights.
The security lesson is where authorization sits. The service did protect its sensitive operations with Polkit, but the unchecked input was handled before Polkit was ever consulted. Reviewing a privileged service means following untrusted data from the first call, not only auditing the permission checks.
The attack is local, so it matters most on shared hosts, build machines and containers where several users or jobs run. The KEV flag is false and I found no report of exploitation in the wild. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.
Quick check
Do I need to worry if dnf5daemon-server is not installed?
No. The report names installation of the package as the only precondition.
Where does 5.1.17 come from?
From the NVD record. The advisory text I read does not state a fix version, so verify with your distribution.
Sources
Last reviewed: 19 October 2026.
