A vulnerability (CVE-2021-3997) has been identified in the systemd utility systemd-tmpfiles, allowing for uncontrolled recursion. This issue can be exploited to perform a denial of service during system boot by creating a large number of nested subdirectories in the /tmp directory. A fix is currently available in the form of a patch. Package updates addressing the issue have been proposed in Ubuntu and SUSE, but are not yet available in Debian, RHEL, and Fedora (fixes are in testing).
When creating thousands of nested directories, executing the "systemd-tmpfiles --remove" command results in a crash due to stack exhaustion. Typically, the systemd-tmpfiles utility performs removal and creation operations in a single call ("systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev"), where removal is executed first followed by creation. Thus, a crash during the removal phase will prevent the creation of crucial files specified in /usr/lib/tmpfiles.d/*.conf.
A more dangerous attack scenario on Ubuntu 21.04 is also mentioned: due to the crash of systemd-tmpfiles, the file /run/lock/subsys is not created, and the /run/lock directory is writable by all users. An attacker can create a /run/lock/subsys directory under their identifier and, by creating symbolic links that intersect with lock files from system processes, orchestrate the overwriting of system files.
Additionally, new releases of the Flatpak, Samba, FreeRDP, Clamav, and Node.js projects have been published, addressing vulnerabilities:
- In the corrective releases of the Flatpak self-contained package building tool versions 1.10.6 and 1.12.3, two vulnerabilities have been fixed: The first vulnerability (CVE-2021-43860) allows certain extended permissions to be hidden during installation when loading a package from an unverified repository through metadata manipulation. The second vulnerability (without a CVE) allows the command "flatpak-builder --mirror-screenshots-url" during package building to create directories in the filesystem area outside the build directory.
- The Samba 4.13.16 update resolves a vulnerability (CVE-2021-43566) that allows a client to exploit symbolic links on SMB1 or NFS partitions to achieve the creation of server The catalog beyond the exported area of the filesystem (the issue is caused by a race condition and is difficult to exploit in practice, though theoretically possible). The problem affects versions prior to 4.13.16.
A report has also been published regarding another similar vulnerability (CVE-2021-20316), which allows an authenticated client to read or modify the contents of a file or metadata in the filesystem area through manipulation of symbolic links. server outside the exported section. The issue has been addressed in release 4.15.0, but it also affects previous branches. However, no fixes for older branches will be published since the old Samba VFS architecture does not allow the problem to be resolved due to the binding of metadata operations to file paths (in Samba 4.15, the VFS layer was completely redone). The danger of the problem is mitigated by the fact that it is quite complex to exploit, and user permissions must allow reading or writing to the target file or directory.
- In the FreeRDP 2.5 project release, which offers a free implementation of the Remote Desktop Protocol (RDP), three security issues have been addressed (CVE identifiers have not been assigned), which may lead to buffer overflow when using an incorrect locale, handling specially crafted registry parameters, and specifying incorrectly formatted extension names. Notable changes in the new version include support for OpenSSL 3.0, implementation of the TcpConnectTimeout setting, improved compatibility with LibreSSL, and resolution of clipboard issues in Wayland-based environments.
- In the new releases of the free antivirus package ClamAV 0.103.5 and 0.104.2, a vulnerability CVE-2022-20698 has been fixed, related to improper pointer reading, which allows remote triggering of a process crash if the package is compiled with the libjson-c library and the CL_SCAN_GENERAL_COLLECT_METADATA option is enabled in the settings (clamscan —gen-json).
- The updates for Node.js versions 16.13.2, 14.18.3, 17.3.1, and 12.22.9 address four vulnerabilities: bypassing certificate checks when verifying network connections due to improper conversion of SAN (Subject Alternative Names) to string format (CVE-2021-44532); improper handling of multiple values in the subject and issuer fields that can be exploited to bypass checks on these fields in certificates (CVE-2021-44533); bypassing restrictions related to SAN-URI type in certificates (CVE-2021-44531); and insufficient input validation in the console.table() function, which could be used to assign empty strings to numeric keys (CVE-2022-21824).
Source: opennet.ru
