In , implementation of the NTP protocol used for synchronizing accurate time across various Linux distributions, vulnerability (), allowing to overwrite any file in the system by having access as a local unprivileged user chrony. The vulnerability can only be exploited through the chrony user, which reduces its danger. However, the issue compromises the isolation level in chrony and could be used if another vulnerability in the code executed after privilege reset is discovered.
The vulnerability is caused by unsafe creation of the pid file, which was created at a stage when chrony had not yet dropped privileges and is running with root rights. The directory /run/chrony, where the pid file is written, was created with permissions 0750 via systemd-tmpfiles or while starting chronyd bound to the user and group 'chrony'. Thus, when having access to the chrony user, there is a possibility of replacing the pid file /run/chrony/chronyd.pid with a symbolic link. The symbolic link can point to any system file that will be overwritten when chronyd starts.
root# systemctl stop chronyd.service
root# sudo -u chrony /bin/bash
chrony$ cd /run/chrony
chrony$ ln -s /etc/shadow chronyd.pid
chrony$ exit
root# /usr/sbin/chronyd -n
^C
# вместо содержимого /etc/shadow будет сохранён идентификатор процесса chronyd
root# cat /etc/shadow
15287
The vulnerability in the release . Updates with vulnerability fixes are available for . During the preparation of the update for , and .
SUSE and openSUSE on the issue , as the symbolic link for chrony is created directly in the /run directory, without using additional subdirectories.
Source: opennet.ru
