Qualys has discovered two vulnerabilities (CVE-2021-44731, CVE-2021-44730) in the snap-confine utility, which is distributed with the SUID root flag and invoked by the snapd process to create the execution environment for applications supplied in self-contained packages in the snap format. The vulnerabilities allow a local unprivileged user to execute code with root privileges in the system. The issues have been resolved in today’s snapd package update for Ubuntu 21.10, 20.04, and 18.04.
The first vulnerability (CVE-2021-44730) allows an attack through manipulation of hard links, but requires disabling the system's hard link protection (setting sysctl fs.protected_hardlinks to 0). The issue is caused by inadequate checking of the locations of the executable files for the snap-update-ns and snap-discard-ns helper tools, which are run with root privileges. The path to these files was calculated in the sc_open_snapd_tool() function based on its own path from /proc/self/exe, allowing the creation of a hard link to snap-confine in the attacker's directory and placing their versions of snap-update-ns and snap-discard-ns in this directory. Running snap-confine through the hard link with root privileges would execute snap-update-ns and snap-discard-ns files from the current directory supplied by the attacker.
The second vulnerability is caused by a race condition and can be exploited in the default Ubuntu Desktop configuration. For the exploit to work successfully in Ubuntu Server, one of the packages from the 'Featured Server Snaps' section must be selected during installation. The race condition manifests in the setup_private_mount() function, which is called during the preparation of the namespace mount points for the snap package. This function creates a temporary directory '/tmp/snap.$SNAP_NAME/tmp' or uses an existing one for bind-mounting the directories for the snap package.
Because the name of the temporary directory is predictable, an attacker could replace its contents with a symbolic link after the owner check but before the mount system call is made. For instance, a symbolic link "\/tmp\/snap.lxd\/tmp" could be created in the directory \/tmp\/snap.lxd, pointing to an arbitrary directory, leading the mount() call to follow the symbolic link and mount the directory in the snap namespace. Similarly, one could mount their own content into \/var\/lib and manage the mounting of their directory \/etc in the snap package namespace to load their library with root privileges by replacing \/etc\/ld.so.preload.
It is noted that creating the exploit proved to be a non-trivial task since the snap-confine utility is written in Go using safe programming practices, has protection based on AppArmor profiles, filters system calls using the seccomp mechanism, and applies namespaces for mounting for isolation. Nonetheless, researchers managed to prepare a working exploit to gain root privileges on the system. The exploit code will be published in a few weeks, after users have installed the provided updates.
Source: opennet.ru
