{"id":105785,"date":"2022-12-02T15:36:49","date_gmt":"2022-12-02T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap"},"modified":"2022-12-02T15:36:49","modified_gmt":"2022-12-02T13:36:49","slug":"root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap","title":{"rendered":"Root-s\u00e5rbarhed i Snap-pakkestyringsv\u00e6rkt\u00f8jet.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Qualys har identificeret en tredje alvorlig s\u00e5rbarhed (CVE-2022-3328) i v\u00e6rkt\u00f8jet snap-confine, som leveres med SUID root-flaget og kaldes af snapd-processen for at danne det udf\u00f8relsesmilj\u00f8, som applikationer distribueres i via selvst\u00e6ndige pakker i snap-format. S\u00e5rbarheden giver en lokal, ikke-privilegeret bruger mulighed for at udf\u00f8re kode med root-rettigheder i standard Ubuntu-konfigurationen. Problemet er blevet rettet i versionen snapd 2.57.6. Updates er blevet udgivet for alle underst\u00f8ttede Ubuntu-versioner. <\/p>\n
Det er interessant, at den aktuelle s\u00e5rbarhed blev indf\u00f8rt som en del af rettelsen af en lignende s\u00e5rbarhed i snap-confine fra februar. Forskere lykkedes med at udarbejde et funktionelt exploit, der giver root-adgang i Ubuntu Server 22.04, og i denne s\u00e5rbarhed er der ogs\u00e5 to s\u00e5rbarheder i multipathd-processen (CVE-2022-41974, CVE-2022-41973), relateret til omg\u00e5else af adgangskontrol ved overf\u00f8rsel af privilegerede kommandoer og usikker h\u00e5ndtering af symbolske links. <\/p>\n
S\u00e5rbarheden i snap-confine skyldes en kapl\u00f8bssituation i funktionen must_mkdir_and_open_with_perms(), der blev tilf\u00f8jet for at beskytte mod at kataloget \/tmp\/snap.$SNAP_NAME bliver \u00e6ndret til et symbolsk link efter ejerkontrollen, men f\u00f8r kaldet til systemopkaldet mount for bind-mounting af kataloger til snap-pakken. Den tilf\u00f8jede beskyttelse bestod i at omd\u00f8be kataloget \/tmp\/snap.$SNAP_NAME til et andet katalog i \/tmp med et tilf\u00e6ldigt navn, hvis det eksisterer og ikke tilh\u00f8rer brugeren root. <\/p>\n
Under brugen af omd\u00f8bningsoperationen af kataloget \/tmp\/snap.$SNAP_NAME udnyttede forskerne, at snap-confine ogs\u00e5 opretter kataloget \/tmp\/snap.rootfs_XXXXXX for roden af indholdet i snap-pakken. Delen «XXXXXX» i navnet v\u00e6lges tilf\u00e6ldigt ved hj\u00e6lp af mkdtemp(), men pakken med navnet «rootfs_XXXXXX» kan best\u00e5 kontrollen i funktionen sc_instance_name_validate (dvs. ideen er, at navnet $SNAP_NAME f\u00e5r v\u00e6rdien «rootfs_XXXXXX», og s\u00e5 vil omd\u00f8bningsoperationen f\u00f8re til overskrivning af kataloget \/tmp\/snap.rootfs_XXXXXX med roden af snap). <\/p>\n
For simultaneous use of \/tmp\/snap.rootfs_XXXXXX and renaming \/tmp\/snap.$SNAP_NAME, two instances of snap-confine were launched. As soon as the first instance created \/tmp\/snap.rootfs_XXXXXX, the process was blocked and the second instance with the package name rootfs_XXXXXX was started, causing the temporary directory \/tmp\/snap.$SNAP_NAME of the second instance to become the root directory \/tmp\/snap.rootfs_XXXXXX of the first. Immediately after performing the renaming, the second instance crashed, and \/tmp\/snap.rootfs_XXXXXX was replaced with a race condition manipulation, as seen in the February vulnerability exploitation. After the replacement, execution blocking was lifted from the first instance, allowing attackers full control over the root directory of the snap. <\/p>\n
At the final stage, a symbolic link \/tmp\/snap.rootfs_XXXXXX\/tmp was created, which was used by the function sc_bootstrap_mount_namespace() for bind-mounting the writable real directory \/tmp into any FS directory, as the mount() call follows symbolic links before mounting. Such mounting is blocked by AppArmor restrictions, but to bypass this block, two auxiliary vulnerabilities in multipathd were exploited. \n Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"