Critical Ping Vulnerability Allows Remote Attackers to Take Over FreeBSD Systems
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-44731 | A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain root privileges by bind-mounting their own contents inside the snap's private mount namespace and causing snap-confine to execute arbitrary code and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1 NVD description · AI analysis pending | 7.8 | <1% | PoC ×4 |
| — | |
| CVE-2022-23093 | ping reads raw IP packets from the network to process responses in the pr_pack() function. ping reads raw IP packets from the network to process responses in the pr_pack() function. As part of processing a response ping has to reconstruct the IP header, the ICMP header and if present a "quoted packet," which represents the packet that generated an ICMP error. The quoted packet again has an IP header and an ICMP header. The pr_pack() copies received IP and ICMP headers into stack buffers for further processing. In so doing, it fails to take into account the possible presence of IP option headers following the IP header in either the response or the quoted packet. When IP options are present, pr_pack() overflows the destination buffer by up to 40 bytes. The memory safety bugs described above can be triggered by a remote host, causing the ping program to crash. The ping process runs in a capability mode sandbox on all affected versions of FreeBSD and is thus very constrained in how it can interact with the rest of the system at the point where the bug can occur. NVD description · AI analysis pending | 6.5 | 2% |
| — | ||
| CVE-2022-3328 | Race condition in snap-confine's must_mkdir_and_open_with_perms() Race condition in snap-confine's must_mkdir_and_open_with_perms() NVD description · AI analysis pending | 7.0 | <1% |
| — | ||
| CVE-2022-41973 +1 in the same advisory: …41974 | multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root. NVD description · AI analysis pending | 7.8 | <1% | PoC ×7 |
| — |
Full article357 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananDec 05, 2022Endpoint Security / Pen Testing
The maintainers of the FreeBSD operating system have released updates to remediate a security vulnerability impacting the ping module that could be potentially exploited to crash the program or trigger remote code execution.
The issue, assigned the identifier CVE-2022-23093, impacts all supported versions of FreeBSD and concerns a stack-based buffer overflow vulnerability in the ping service.
"ping reads raw IP packets from the network to process responses in the pr_pack() function," according to an advisory published last week.
"The pr_pack() copies received IP and ICMP headers into stack buffers for further processing. In so doing, it fails to take into account the possible presence of IP option headers following the IP header in either the response or the quoted packet."
As a consequence, the destination buffer could be overflowed by up to 40 bytes when the IP option headers are present.
The FreeBSD Project noted that the ping process runs in a capability mode sandbox and is therefore constrained in how it can interact with the rest of the operating system.
OPNsense, an open source, FreeBSD-based firewall and routing software, has also released a patch (version 22.7.9) to plug the security hole, along with other issues.
The findings come as researchers from Qualys detailed another new vulnerability in the snap-confine program in the Linux operating system, building upon a previous privilege escalation flaw (CVE-2021-44731) that came to light in February 2022.
Snaps are self-contained application packages that can be distributed by upstream developers to users.
The new shortcoming (CVE-2022-3328), introduced as part of a patch for CVE-2021-44731, can be chained with two other flaws in multipathd called Leeloo Multipath – an authorization bypass and a symlink attack tracked as CVE-2022-41974 and CVE-2022-41973 – to gain root privileges.
Since the multipathd daemon runs by default as root, a successful exploitation of the flaws could enable an unprivileged threat actor to obtain the highest permissions on the vulnerable host and execute arbitrary code.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/12/critical-ping-vulnerability-allows.html