Nimbuspwn bugs allow attackers to gain root privileges on some Linux machines (CVE-2022-29799, CVE-2022-29800)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-0847 | Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel CVE-2022-0847, widely known as 'Dirty Pipe,' is a privilege escalation flaw in the Linux kernel caused by improper initialization of the 'flags' member of the new pipe buffer structure in the copy_page_to_iter_pipe and push_pipe functions, allowing stale flag values to persist (CWE-665). An unprivileged local user can trigger the flaw by writing through a pipe into the page cache of files they can read, overwriting the contents of otherwise read-only files. This enables tampering with privileged files — for example, hijacking SUID binaries per the public proof-of-concepts — to escalate privileges to root on the local system. Affected products include the Linux kernel as tracked by CISA, with downstream distribution and appliance vendors Fedora, Red Hat Enterprise Linux (including EUS, IBM Z, Power little-endian, and Real Time/NFV variants), oVirt, NetApp, Siemens, and SonicWall. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-04-25), carries an 89.7% EPSS probability of exploitation within 30 days, and multiple public proof-of-concept exploits are available. Do: Apply vendor-supplied fixed kernel updates immediately per the CISA KEV required action, including patches from Fedora and Red Hat Enterprise Linux (all listed variants) and from oVirt, NetApp, Siemens, and SonicWall appliances or products that embed affected kernels; verify the running kernel version on hosts, container hosts, and appliances and reboot into the patched kernel. There is no complete workaround — the kernel itself must be patched — so prioritize multi-user servers, systems running untrusted code or containers, and internet-exposed appliances, since any local account can gain root. | 7.8 | 90% | KEV PoC ×4 |
| mass≈1 billion+ Linux-based systems (servers, cloud VMs, Android/embedded devices) potentially vulnerable on unpatched kernels | |
| CVE-2022-29799 +1 in the same advisory: …29800 | A vulnerability was found in networkd-dispatcher. A vulnerability was found in networkd-dispatcher. This flaw exists because no functions are sanitized by the OperationalState or the AdministrativeState of networkd-dispatcher. This attack leads to a directory traversal to escape from the “/etc/networkd-dispatcher” base directory. NVD description · AI analysis pending | 5.5 group max | 12% | PoC |
| — |
Full article360 words · extracted from helpnetsecurity.com · click to collapse
Microsoft has unearthed two security vulnerabilities (CVE-2022-29799, CVE-2022-29800) in the networkd-dispatcher daemon that may be exploited by attackers to gain root on many Linux endpoints, allowing them to deploy backdoors, malware, ransomware, or perform other malicious actions.
About the vulnerabilities (CVE-2022-29799, CVE-2022-29800)
CVE-2022-29799 is a directory traversal bug; CVE-2022-29800 is a time-of-check-time-of-use (TOCTOU) race condition that could allow an attacker to replace scripts that networkd-dispatcher (the vulnerable systemd unit) believes to be owned by root to ones that are not. Add to this a symlink race condition that was also simultaneously discovered by the researchers, and you have an open path to achieving elevation of privilege.
In their experiments, researchers managed to win the TOCTOU race condition in three attempts:
They’ve also made the exploit deliver a root backdoor, to allow for permanent root capabilities.
Jonathan Bar Or from the Microsoft 365 Defender Research Team detailed their discovery in this blog post, and said that Clayton Craft – the maintainer of the networkd-dispatcher – has fixed them earlier this month.
The question now remains which Linux distributions use the vulnerable networkd-dispatcher.
Bar Or says that their exploit is effective only if it can use the “org.freedesktop.network1” bus name – and this is possible in several environments.
He mentions Linux Mint, which is based on Ubuntu (which, in its turn, is based on Debian), and a quick search reveals that networkd-dispatcher is packaged in those distros – though possibly not installed by default on all installations.
To conclude: While the danger of wide exploitation of the Nimbuspwn bugs looks to be much lower than that of the recently discovered Dirty Pipe and PwnKit flaws, Linux users and admins should be on the lookout for patches and implement them if/when they become available.
It’s true that vulnerabilities that allow local elevation of privilege are less critical that those that allow unauthenticated remote code execution, as attackers must first find a way to gain access to the target system before even thinking about starting to exploit them. Still, they are regularly taken advantage of by attackers – Dirty Pipe (CVE-2022-0847) has, for example, been added to CISA’s Known Exploited Vulnerabilities Catalog on Monday.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/04/27/cve-2022-29799-cve-2022-29800/