Den baggrundsproces, der er relateret til networkd-dispatcher, k\u00f8rer med root-rettigheder og modtager signaler om h\u00e6ndelser gennem D-Bus-bussen. Oplysninger om h\u00e6ndelser relateret til \u00e6ndring af netv\u00e6rksforbindelsens tilstand sendes af tjenesten systemd-networkd. Problemet er, at ikke-privilegerede brugere kan generere en h\u00e6ndelse om en ikke-eksisterende tilstand og initiere k\u00f8rsel af deres script, som vil blive udf\u00f8rt med root-rettigheder. <\/p>\n
Systemd-networkd er designet til kun at k\u00f8re systemets handler-scripts, der findes i kataloget \/etc\/networkd-dispatcher, og som ikke kan \u00e6ndres af brugeren, men p\u00e5 grund af en s\u00e5rbarhed (CVE-2022-29799) i filbehandlingskoden var der mulighed for at forlade basis-kataloget og k\u00f8re vilk\u00e5rlige scripts. Specifikt, da filstien til scriptet blev dannet, blev de v\u00e6rdier for OperationalState og AdministrativeState, der blev sendt via D-Bus, anvendt uden rensning for specielle tegn. En angriber kunne generere sin egen tilstand, hvis navn indeholdt tegnene \u00ab..\/\u00bb og omdirigere networkd-dispatcher til et andet katalog. <\/p>\n
Den anden s\u00e5rbarhed (CVE-2022-29800) er relateret til en race-tilstand \u2014 der var et lille tidsrum mellem kontrol af scriptparameterne (hvis de tilh\u00f8rte root) og deres udf\u00f8relse, tilstr\u00e6kkeligt til at erstatte filen og omg\u00e5 kontrollen af, om scriptet tilh\u00f8rte brugeren root. Derudover manglede networkd-dispatcher kontrol for symbolske links, ogs\u00e5 ved udf\u00f8relse af scripts gennem subprocess.Popen, hvilket v\u00e6sentligt lettede angrebsorganisationen. <\/p>\n
Brugsanvisning: <\/p>\n
- \n
- Der oprettes et katalog \u00ab\/tmp\/nimbuspwn\u00bb og et symbolsk link \u00ab\/tmp\/nimbuspwn\/poc.d\u00bb, der peger p\u00e5 kataloget \u00ab\/sbin\u00bb, som bruges til at best\u00e5 kontrol for at finde eksekverbare filer, der tilh\u00f8rer root.\n
- For de eksekverbare filer fra \u00ab\/sbin\u00bb oprettes filer med samme navn i kataloget \u00ab\/tmp\/nimbuspwn\u00bb, for eksempel oprettes filen \u00ab\/tmp\/nimbuspwn\/vgs\u00bb for filen \u00ab\/sbin\/vgs\u00bb, som tilh\u00f8rer en ikke-privilegeret bruger, og hvor koden, som angriberen \u00f8nsker at k\u00f8re, placeres.\n
- Via D-Bus sender networkd-dispatcher et signal, der angiver OperationalState med v\u00e6rdien \u00ab..\/..\/..\/tmp\/nimbuspwn\/poc\u00bb. For at sende signalet i navnerummet \u00aborg.freedesktop.network1\u00bb blev muligheden for at tilslutte egne h\u00e5ndterere til systemd-networkd anvendt, for eksempel gennem manipulation med gpgv eller epmd, eller man kan udnytte, at systemd-networkd ikke k\u00f8rer som standard (for eksempel i Linux Mint).\n
- Efter modtagelse af signalet bygger Networkd-dispatcher en liste over eksekverbare filer, der tilh\u00f8rer brugeren root og er tilg\u00e6ngelige i kataloget \u00ab\/etc\/networkd-dispatcher\/..\/..\/..\/tmp\/nimbuspwn\/poc.d\u00bb, som i realiteten refererer til \u00ab\/sbin\u00bb.\n
- I det \u00f8jeblik, hvor fillisten er modtaget, men scriptet endnu ikke er k\u00f8rt, bliver den symbolske link omdirigeret fra \u00ab\/tmp\/nimbuspwn\/poc.d\u00bb til \u00ab\/tmp\/nimbuspwn\u00bb, og networkd-dispatcher vil k\u00f8re scriptet, der er placeret af angriberen, med root-rettigheder. <\/ul>\n
![\"S\u00e5rbarheder](\"\/wp-content\/uploads\/2022\/04\/15109315e192eb6384601dfafc436775.jpg\")
<\/center>
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Microsoft \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-29799, CVE-2022-29800) \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 networkd-dispatcher, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Nimbuspwn \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 networkd-dispatcher 2.2. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u043c\u0438 \u043f\u043e\u043a\u0430 \u043d\u0435\u0442 (Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux). Networkd-dispatcher \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Ubuntu, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":103886,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103885","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarheder i networkd-dispatcher, der giver adgang til root-rettigheder | ProHoster","description":"Sikkerhedsforskere fra Microsoft har identificeret to s\u00e5rbarheder (CVE-2022-29799, CVE-2022-29800) i tjenesten networkd-dispatcher, der har kodenavnet Nimbuspwn og tillader en ikke-privilegeret bruger.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-networkd-dispatcher-pozvolyayushhie-poluchit-prava-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 networkd-dispatcher, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Microsoft \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-29799, CVE-2022-29800) \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 networkd-dispatcher, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Nimbuspwn \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimosti-v-networkd-dispatcher-pozvolyayushhie-poluchit-prava-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-04-27T13:36:49+00:00","article:modified_time":"2022-04-27T13:36:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103885","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 15:22:48","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-04-27 13:37:05","updated":"2026-02-04 15:22:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/103885","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=103885"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/103885\/revisions"}],"predecessor-version":[{"id":156835,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/103885\/revisions\/156835"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/103886"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=103885"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=103885"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=103885"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}