Week in review: Linux bug gives root access to attackers, UPS devices' vulns, IoT security for OEMs
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-0847 | Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel CVE-2022-0847, widely known as 'Dirty Pipe,' is a privilege escalation flaw in the Linux kernel caused by improper initialization of the 'flags' member of the new pipe buffer structure in the copy_page_to_iter_pipe and push_pipe functions, allowing stale flag values to persist (CWE-665). An unprivileged local user can trigger the flaw by writing through a pipe into the page cache of files they can read, overwriting the contents of otherwise read-only files. This enables tampering with privileged files — for example, hijacking SUID binaries per the public proof-of-concepts — to escalate privileges to root on the local system. Affected products include the Linux kernel as tracked by CISA, with downstream distribution and appliance vendors Fedora, Red Hat Enterprise Linux (including EUS, IBM Z, Power little-endian, and Real Time/NFV variants), oVirt, NetApp, Siemens, and SonicWall. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-04-25), carries an 89.7% EPSS probability of exploitation within 30 days, and multiple public proof-of-concept exploits are available. Do: Apply vendor-supplied fixed kernel updates immediately per the CISA KEV required action, including patches from Fedora and Red Hat Enterprise Linux (all listed variants) and from oVirt, NetApp, Siemens, and SonicWall appliances or products that embed affected kernels; verify the running kernel version on hosts, container hosts, and appliances and reboot into the patched kernel. There is no complete workaround — the kernel itself must be patched — so prioritize multi-user servers, systems running untrusted code or containers, and internet-exposed appliances, since any local account can gain root. | 7.8 | 90% | KEV PoC ×4 |
| mass≈1 billion+ Linux-based systems (servers, cloud VMs, Android/embedded devices) potentially vulnerable on unpatched kernels | |
| CVE-2022-26486 +1 in the same advisory: …26485 | Use-After-Free Sandbox Escape in Mozilla Firefox and Thunderbird CVE-2022-26486 is a use-after-free (CWE-416) in the WebGPU inter-process communication (IPC) framework of Mozilla Firefox, triggered when the IPC framework receives an unexpected message. An attacker who can get the browser to process malicious content gains a sandbox escape from the compromised content process, and the flaw was chained with the sibling zero-day CVE-2022-26485 in attacks observed in the wild. Users of Firefox, Firefox ESR, Firefox for Android, Firefox Focus, and Thunderbird running builds prior to the patched releases are affected. Exploitation is confirmed in the wild: the issue was disclosed as a zero-day, added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-07, and CISA urged defenders to patch promptly. Mozilla rated the fix urgent, and the flaw carries a critical CVSS 3.1 score of 9.6 with an EPSS 30-day exploitation probability of about 2.3%. Do: Upgrade immediately: Firefox to 97.0.2 or later, Firefox ESR to 91.6.1 or later, Firefox for Android and Firefox Focus to 97.3.0 or later, and Thunderbird to 91.6.2 or later. Prioritize this patch because the flaw is a confirmed zero-day in CISA KEV; inventory managed endpoints for outdated Firefox/Thunderbird builds and, as an interim mitigation, consider disabling or restricting WebGPU where feasible until updates are applied. | 9.6 group max | 2% | KEV PoC ×2 |
| massplausibly hundreds of millions of users (Firefox alone has roughly 200M+ active users worldwide, plus Firefox for Android and Thunderbird installs) |
Full article1,195 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news, articles and interviews:
Mozilla fixes Firefox zero-days exploited in the wild (CVE-2022-26485, CVE-2022-26486)
Mozilla has released an out-of-band security update for Firefox, Firefox Focus, and Thunderbird, fixing two critical vulnerabilities (CVE-2022-26485, CVE-2022-26486) exploited by attackers in the wild.
Easily exploitable Linux bug gives root access to attackers (CVE-2022-0847)
An easily exploitable vulnerability (CVE-2022-0847) in the Linux kernel can be used by local unprivileged users to gain root privileges on vulnerable systems by taking advantage of already public exploits.
Widely used UPS devices can be hijacked and destroyed remotely
Three vulnerabilities in ubiquitous APC Smart-UPS (uninterruptible power supply) devices could allow remote attackers to use them as an attack vector, disable or completely destroy them, Armis researchers have discovered.
March 2022 Patch Tuesday: Microsoft fixes RCEs in RDP client, Exchange Server
Microsoft marks March 2022 Patch Tuesday with patches for 71 CVE-numbered vulnerabilities, including three previously unknown “critical” ones and three “important” ones that were already public (but not actively exploited by attackers).
War in Ukraine: What type of cyber attacks can we expect next?
The cyber activities related to the ongoing war in Ukraine have run the gamut from wiper malware hitting organizations and the border control in Ukraine, DDoS attacks aimed at government and media websites, and cyber disruption of satellite-based internet service, to preparations for watering hole attacks, next-level disinformation campaigns, and phishing campaigns.
Kali Linux on bare-metal gets snapshotting functionality
The Offensive Security team has released Kali Unkaputtbar, a new feature that allows Kali Linux installed on bare-metal to make system snapshots automatically, thus enabling users to roll back to a previous system state after a botched upgrade.
Every business is a cybersecurity business
Hybrid working, with some staff dialing in remotely and others based in the office, forms the basis of how many organizations work, yet many businesses are still not fully equipped for the inevitable security risks that decentralization creates.
Sharp rise in SMB cyberattacks by Russia and China
SaaS Alerts unveiled the findings of its latest report which analyzed approximately 136 million SaaS security events across 2,100 small and medium businesses (SMBs) globally and identified cyber trends negatively impacting businesses.
5 steps that simplify IoT security for OEMs
As digital transformation materializes, businesses are becoming more reliant on devices that support valuable IoT services. As the reliance on these devices grows, so does the number of cyberattacks on connected solutions.
BBC targeted with 383,278 spam, phishing and malware attacks every day
The BBC (British Broadcasting Corporation) were the target of nearly 50 million malicious email attacks between 1st October 2021 and the end of January 2022.
Increasing security for single page applications (SPAs)
Single page applications (SPAs) have become the most popular way to create websites that feel faster for the end-user without hitting the server every time a user interacts with an application.
IT leaders confident in their ability to manage a ransomware attack: They should know better
ExtraHop released findings from a survey on ransomware that sheds light on the discrepancies between how IT decision makers (ITDMs) see their current security practices, and the reality of the ransomware attack landscape.
Understanding US Defense Department’s relaxed cybersecurity protocols under CMMC 2.0
Department of Defense (DoD) contractors struggling to comply with upcoming cybersecurity regulations under the Cybersecurity Maturity Model Certification (CMMC) can breathe a sigh of relief—the DoD has announced its intent to release CMMC 2.0, with promises to streamline the certification process and ease security regulations for contractors and sub-contractors handling low-priority information.
70% of breached passwords are still in use
SpyCloud announced a report that examines trends related to exposed data. Researchers identified 1.7 billion exposed credentials, a 15% increase from 2020, and 13.8 billion recaptured Personally Identifiable Information (PII) records obtained from breaches in 2021.
Data privacy laws are an opportunity to become more honest in reaching your target audience
Data privacy regulations are designed to give consumers more transparency into and control over how their data is collected, shared and used, especially as more consumers grow concerned about how their data is accessed and used by big data companies.
How frustrated and burned out are security analysts?
Security analysts play a vital role ensuring that their organizations stay safe and secure. But barriers to their work, like a lack of staff, overwork, and tedious tasks are causing frustration and burnout, a Tines report reveals.
Why are CAPTCHAs still used?
The success of your online business hinges on your customers’ ability to properly recognize crosswalks or traffic lights. I’m, of course, referring to CAPTCHAs, the online security tool that asks end users to prove they’re human by recognizing specific elements in various images.
Organizations need to change their current password usage and policies, and do it fast
Password-related attacks are on the rise. Stolen user credentials including name, email and password were the most common root cause of breaches in 2021 with several high-profile and disruptive attacks over the last two years on SolarWinds, Colonial Pipeline, and others made possible by hackers stealing a single password.
Does the future of digital identity offer us greater security and convenient experiences?
Much of the promise associated with future digital identity infrastructures is associated with greater automation of the identity lifecycle and the provision of greater control of personal data to end-users.
ICS vulnerability disclosures surge 110% over the last four years
Industrial control system (ICS) vulnerability disclosures grew a staggering 110% over the last four years, with a 25% increase in the second half (2H) of 2021 compared to the previous six months, according to a research released by Claroty.
Fraud detection and prevention costs merchants more than fraud itself
European merchants spent nearly €7 billion on fraud detection and prevention in 2021 alone – more than three times the value lost to fraud in the same year, CMSPI estimates.
Small business owners worried about the cybersecurity of their commercial vehicles
Small business owners are adding electric vehicles to their service fleets, a survey released by HSB reports, but they worry about cybersecurity when connecting them to public charging stations.
Mid-market tackling high rate of costly attacks, worsened by complex, siloed defences and staff burnout
Mid-market organizations in the UK suffered significant financial and operational damage as a result of cyberattacks in 2021, and want to see fundamental change to how cybersecurity is designed and run, a Censornet research reveals.
Start a cybersecurity career with the help of (ISC)², exam costs only $125
There’s never been a time when entry-level cybersecurity professionals were more in demand. Starting your career with a certification from (ISC)² means you’re showing potential employers that you have the drive, knowledge and skills to succeed.
Improve your organization’s cyber hygiene with CIS CSAT Pro
Essential cyber hygiene is the foundation for any good cybersecurity program. The Center for Internet Security (CIS) defines essential cyber hygiene as Implementation Group 1 (IG1) of the CIS Critical Security Controls (CIS Controls).
New infosec products of the week: March 11, 2022
Here’s a look at the most interesting products from the past week, featuring releases from AvePoint, Dasera, Elastic, Imperva, Palo Alto Networks, Reciprocity, SpyCloud, and Veeam.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/03/13/week-in-review-linux-bug-gives-root-access-to-attackers-ups-devices-vulns-iot-security-for-oems/