[SECURITY] libapt-pkg: wild pointer dereference and daemon crash via versionless stanza in debDebFileParser::UsePackage

Dear Ubuntu Security Team,

My name is Christos Papakonstantinou, and I am a Security Researcher at
Cantina Security (https://www.cantina.security/), a leading cybersecurity
firm specializing in AI security.

We identified a vulnerability in libapt-pkg 2.8.3 (shipped in Ubuntu 24.04
noble). When a `.deb` package's control file contains a `Package:` field
but no `Version:` field, the cache generator creates a default-constructed
`VerIterator` (`_item == 0`), which points at the cache Header structure.
When `Ver.VerStr()` is called from `debDebFileParser::UsePackage`, it
computes `StrP + Header.Signature` (where `Header.Signature ==
0x98FE76DC`), producing a wild pointer ~2.5 GB past the string pool. The
resulting `strlen()` causes a deterministic SIGSEGV, crashing the
root-running `packagekitd` daemon. This is reachable by an unprivileged
user via the PackageKit D-Bus `GetDetailsLocal` method, which requires no
polkit authentication. The bug remains unfixed in upstream apt main. A
sibling bug (unguarded trim loop, U-1) was fixed upstream in apt 3.3.2
(commit `8ab7abcf0a`, 2026-07-13) but was not backported to noble.

Here is the link to the private GitHub Gist containing the full report:
https://gist.github.com/christos-spearbit/2a68ff55883bf58fa96516c7c613ffb4

We are always committed to responsible disclosure in accordance with your
security policy.

Please feel free to reply to this email with any questions or requests for
additional details. Thanks a lot!

Best,
Christos Papakonstantinou
Security Researcher at Cantina Security