Three Innocuous Linux Vulnerabilities Chained to Obtain Full Root Privileges

1 year ago 55

BOOK THIS SPACE FOR AD

ARTICLE AD

Qualys’ Threat Research Unit has shown how a new Linux vulnerability could be chained with two other apparently harmless flaws to gain full root privileges on an affected system.

The new vulnerability, tracked as CVE-2022-3328, is a race condition in Snapd, a Canonical-developed tool used for the Snap software packaging and deployment system. Specifically, the flaw impacts the ‘snap-confine’ program used by Snapd to construct the execution environment for Snap applications.

The affected program is present by default in Ubuntu, whose developers described CVE-2022-3328 as a high-severity flaw that can be exploited for local privilege escalation and arbitrary code execution.

Qualys researchers have shown how CVE-2022-3328 could be combined with other innocuous vulnerabilities for a high-impact attack.

The researchers chained CVE-2022-3328 — this issue was introduced in February 2022 by the patch for a flaw tracked as CVE-2021-44731 — with two recently discovered issues affecting Multipathd. Multipathd is a daemon in charge of checking for failed paths that is running as root in the default installation of Ubuntu and other distributions.

Multipathd is affected by an authorization bypass issue that can be exploited by an unprivileged user to issue privileged commands to Multipathd (CVE-2022-41974), and a symlink attack (CVE-2022-41973) that can be used to force the execution of malicious code.

Chaining the Snapd vulnerability with the two Multipathd flaws can allow any unprivileged user to gain root privileges on a vulnerable device.

“Qualys security researchers have verified the vulnerability, developed an exploit and obtained full root privileges on default installations of Ubuntu,” Qualys said.

The vulnerability is not exploitable remotely, but the cybersecurity firm warns that it’s dangerous because it can be exploited by an unprivileged user.

Qualys has made available an advisory containing technical information, but a proof-of-concept (PoC) exploit is not being released at this time.

The US Cybersecurity and Infrastructure Security Agency (CISA) is aware of more than a dozen Linux vulnerabilities that have been exploited in attacks, including a flaw exploited in the wild by a stealthy Linux malware named Shikitega, and the security hole known as PwnKit.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Read Entire Article