New Glibc Flaw Grants Attackers Root Access on Major Linux Distros
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-4911 | Buffer Overflow in GNU C Library ld.so Grants Root via SUID Binaries CVE-2023-4911 ('Looney Tunables') is a buffer overflow in the GNU C Library's dynamic loader (ld.so) that occurs while processing the GLIBC_TUNABLES environment variable. A local attacker triggers it by launching a set-user-ID (SUID) binary with a maliciously crafted GLIBC_TUNABLES value, corrupting memory in the privileged process. This allows the attacker to execute code with elevated (root) privileges on the host. Any system running an affected glibc is potentially exposed, including major Linux distributions (Fedora, Red Hat, Canonical, Debian), Red Hat CodeReady Linux Builder channels, NetApp products, and Siemens SIMATIC S7-1500 firmware, although exploitation requires local execution capability or a foothold on the machine. Exploitation is confirmed in the wild: Qualys published a working proof-of-concept, the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-11-21, and Kinsing threat actors have used it for cryptojacking and to breach cloud environments. Do: Install patched glibc updates from your distribution vendor (Fedora, Red Hat, Canonical/Ubuntu, Debian) and apply Siemens firmware updates for affected SIMATIC S7-1500 MFP devices; NetApp customers should follow NetApp's remediation guidance. Until patched, audit SUID/SGID binaries (which the attacker needs as the escalation trigger) and limit untrusted local access and shell access on multi-user or cloud-hosted Linux systems. Per the CISA KEV required action, apply vendor mitigations or discontinue use, prioritizing internet-facing hosts given active Kinsing cryptojacking and cloud-breach activity. | 7.8 | 81% | KEV PoC ×6 |
| masshundreds of millions of Linux installations worldwide (glibc is the standard C library shipped with virtually every major distribution) | |
| CVE-2023-6246 | A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer. NVD description · AI analysis pending | 7.8 group max | 5% | PoC ×6 |
| — |
Full article299 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 31, 2024Vulnerability / Endpoint Security
Malicious local attackers can obtain full root access on Linux machines by taking advantage of a newly disclosed security flaw in the GNU C library (aka glibc).
Tracked as CVE-2023-6246 (CVSS score: 7.8), the heap-based buffer overflow vulnerability is rooted in glibc's __vsyslog_internal() function, which is used by syslog() and vsyslog() for system logging purposes. It's said to have been accidentally introduced in August 2022 with the release of glibc 2.37.
"This flaw allows local privilege escalation, enabling an unprivileged user to gain full root access," Saeed Abbasi, product manager of the Threat Research Unit at Qualys, said, adding it impacts major Linux distributions like Debian, Ubuntu, and Fedora.
A threat actor could exploit the flaw to obtain elevated permissions via specially crafted inputs to applications that employ these logging functions.
"Although the vulnerability requires specific conditions to be exploited (such as an unusually long argv[0] or openlog() ident argument), its impact is significant due to the widespread use of the affected library," Abbasi noted.
The cybersecurity firm said further analysis of glibc unearthed two more flaws in the __vsyslog_internal() function (CVE-2023-6779 and CVE-2023-6780) and a third bug in the library's qsort() function that can lead to memory corruption.
The vulnerability found in qsort() has affected all glibc versions released since 1992.
The development comes nearly four months after Qualys detailed another high-severity flaw in the same library called Looney Tunables (CVE-2023-4911, CVSS score: 7.8) that could result in privilege escalation.
"These flaws highlight the critical need for strict security measures in software development, especially for core libraries widely used across many systems and applications," Abbasi said.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/01/new-glibc-flaw-grants-attackers-root.html