Experts spotted a new stealthy Linux malware dubbed Shikitega
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-3493 | Linux Kernel overlayfs Local Privilege Escalation via User Namespace Flaw The overlayfs stacking file system in the Linux kernel does not properly validate the application of file capabilities against user namespaces, so capability checks can be bypassed when overlayfs is used inside a user namespace (CWE-862, missing authorization). A local attacker who can create user namespaces and mount an overlayfs filesystem can place a file with crafted file capabilities on that mount and execute it, gaining capabilities beyond their own namespace and escalating to root on the host. Any Linux deployment that enables unprivileged user namespaces with overlayfs support is affected; the flaw is specific to distribution kernels exposing this feature (known to affect Ubuntu builds), not every upstream kernel configuration. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2022-10-20, confirming exploitation in the wild, though no public proof-of-concept is catalogued in the source data and EPSS estimates a roughly 49% probability of exploitation within 30 days. Do: Apply updated kernel packages from your distribution per vendor instructions, as CISA's KEV entry requires, and reboot into the patched kernel (Ubuntu resolved this flaw in its July 2021 kernel security updates). As an interim mitigation, restrict or disable unprivileged user namespaces via system policy or sysctl and limit local access to trusted users. Verify the running kernel version after reboot, since the fix is not effective until the system boots the updated kernel. | 7.8 | 49% | KEV PoC ×2 |
| masshundreds of millions of Linux systems deployed overall, with the vulnerable subset (kernels exposing overlayfs via user namespaces, notably Ubuntu) plausibly… | |
| CVE-2021-4034 | Out-of-Bounds Read/Write Local Privilege Escalation in polkit pkexec (PwnKit) CVE-2021-4034 ('PwnKit') is an out-of-bounds read and write (CWE-125/CWE-787) in polkit's setuid-root pkexec utility, which mishandles the calling parameter count and ends up trying to execute environment variables as commands. A local attacker who runs pkexec with crafted environment variables can induce it to execute arbitrary code, gaining administrative (root) rights on the target machine. Because polkit is installed by default on mainstream Linux distributions — including Red Hat Enterprise Linux and its many variants, with the flaw also tracked against Canonical, SUSE, Oracle, Siemens, and StarWind Software products — essentially every standard Linux installation was exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-06-27 with known ransomware use, and EPSS assigns a 94.9% probability of exploitation (100th percentile). Public proof-of-concept exploits are widely available, making exploitation trivial for any user with local access to an unpatched host. Do: Apply the polkit/pkexec updates from each distribution vendor immediately per vendor instructions, as required by the CISA KEV catalog. If patching must be delayed, removing the setuid bit from pkexec (e.g., chmod 0755 /usr/bin/pkexec) is a widely documented interim mitigation, though it may affect functionality that relies on pkexec. Prioritize hosts where untrusted or low-privilege users can log in, and hunt for prior exploitation given known ransomware use. | 7.8 | 95% | KEV ransomware PoC ×4 |
| masstens of millions of Linux servers and workstations (polkit/pkexec ships by default on virtually all mainstream distributions) |
Full article402 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 07, 2022
A new Linux malware dubbed Shikitega leverages a multi-stage infection chain to target endpoints and IoT devices.
Researchers from AT&T Alien Labs discovered a new piece of stealthy Linux malware, dubbed Shikitega, that targets endpoints and IoT devices. The malware stands out for its multistage infection chain, threat actors use it to gain full control of the system and carry out other malicious activities, including cryptocurrency mining.
Shikitega can download next-stage payloads from a C2 server and execute them directly in memory, making it highly evasive.
The experts reported that the malware downloads and executes Metasploit’s “Mettle” meterpreter to take over infected machines.
Shikitega exploits vulnerabilities to elevate privileges and maintain persistence. The researchers observed that it uses a polymorphic encoder to avoid detection by anti-virus engines.
The main dropper of the malware is a small ELF file (370 bytes in size), while the size of the actual code is around 300 bytes.
“The malware uses the “Shikata Ga Nai” polymorphic XOR additive feedback encoder, which is one of the most popular encoders used in Metasploit. Using the encoder, the malware runs through several decode loops, where one loop decodes the next layer, until the final shellcode payload is decoded and executed.” reads the analysis published by AT&T Alien Labs. “After several decryption loops, the final payload shellcode will be decrypted and executed.”
Once the malware was installed on a targeted host, it downloaded and executed the Metasploit “Mettle” meterpreter to maximize control over the system and perform multiple operations.
This adds to a growing list of Linux malware observed in the wild in recent months, including BPFDoor, Symbiote, Syslogk, OrBit, and Lightning Framework.
The malware achieves privilege escalation by exploiting CVE-2021-4034 (aka PwnKit) and CVE-2021-3493. The malware leverages the exploit to download and execute the final stage with root privileges, persistence and the payload of the malware.
“Threat actors continue to search for ways to deliver malware in new ways to stay under the radar and avoid detection. Shiketega malware is delivered in a sophisticated way, it uses a polymorphic encoder, and it gradually delivers its payload where each step reveals only part of the total payload. In addition, the malware abuses known hosting services to host its command and control servers. Stay safe!” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook
(SecurityAffairs – hacking, Log4Shell)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/135437/malware/shikitega-linux-malware.html