New Linux Privilege Escalation Flaw Uncovered in Snap Package Manager
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-3996 +1 in the same advisory: …3995 | A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems. NVD description · AI analysis pending | 5.5 | <1% | PoC |
| — | |
| CVE-2021-3997 | A flaw was found in systemd. A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp. NVD description · AI analysis pending | 5.5 | 2% | PoC |
| — | |
| CVE-2021-3999 +1 in the same advisory: …3998 | A flaw was found in glibc. A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system. NVD description · AI analysis pending | 7.8 group max | <1% | PoC |
| — | |
| CVE-2021-44730 +1 in the same advisory: …44731 | snapd 2.54.2 did not properly validate the location of the snap-confine binary. snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to cause snap-confine to execute other arbitrary binaries and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1 NVD description · AI analysis pending | 8.8 group max | <1% |
| — |
Full article362 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananFeb 18, 2022
Multiple security vulnerabilities have been disclosed in Canonical's Snap software packaging and deployment system, the most critical of which can be exploited to escalate privilege to gain root privileges.
Snaps are self-contained application packages that are designed to work on operating systems that use the Linux kernel and can be installed using a tool called snapd.
Tracked as CVE-2021-44731, the issue concerns a privilege escalation flaw in the snap-confine function, a program used internally by snapd to construct the execution environment for snap applications. The shortcoming is rated 7.8 on the CVSS scoring system.
"Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host," Bharat Jogi, director of vulnerability and threat research at Qualys, said, adding the weakness could be abused to "obtain full root privileges on default installations of Ubuntu."
Red Hat, in an independent advisory, described the issue as a "race condition" in the snap-confine component.
"A race condition in snap-confine exists when preparing a private mount namespace for a snap," the company noted. "This could allow a local attacker to gain root privileges by bind-mounting their own contents inside the snap's private mount namespace and causing snap-confine to execute arbitrary code and hence privilege escalation."
Additionally discovered by the cybersecurity firm are six other flaws –
- CVE-2021-3995 – Unauthorized unmount in util-linux's libmount
- CVE-2021-3996 – Unauthorized unmount in util-linux's libmount
- CVE-2021-3997 – Uncontrolled recursion in systemd's systemd-tmpfiles
- CVE-2021-3998 – Unexpected return value from glibc's realpath()
- CVE-2021-3999 – Off-by-one buffer overflow/underflow in glibc's getcwd()
- CVE-2021-44730 – Hardlink attack in snap-confine's sc_open_snapd_tool()
The vulnerability was reported to the Ubuntu security team on October 27, 2021, following which patches were released on February 17 as part of a coordinated disclosure process.
Qualys also pointed out that while the flaw isn't remotely exploitable, an attacker that has logged in as an unprivileged user can "quickly" exploit the bug to gain root permissions, necessitating that the patches are applied as soon as possible to mitigate potential threats.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/02/new-linux-privilege-escalation-flaw.html