Qualys has identified a critical vulnerability (CVE-2023-4911) in the ld.so loader, which is part of the Glibc (GNU libc) system C library. This vulnerability allows a local user to escalate their privileges by specifying specially crafted data in the GLIBC_TUNABLES environment variable before executing a file with the suid root flag, for example, /usr/bin/su.
The successful exploitation of this vulnerability has been demonstrated on Fedora 37 and 38, Ubuntu 22.04 and 23.04, Debian 12 and 13. It is believed that the vulnerability also exists in any other distributions using Glibc. Distributions based on the Musl system C library, such as Alpine Linux, are not affected. The vulnerability has been patched as of October 2. Updates for packages in distributions can be tracked on the pages for Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora, Arch, Gentoo, and ALT Linux.
The vulnerability was introduced by a change made in April 2021, included in the glibc 2.34 release. Due to a parsing error in the string specified in the GLIBC_TUNABLES environment variable, an incorrect combination of parameters in this variable leads to writing the parsed value beyond the allocated buffer. The issue arises when instead of standard sequences "name=val", parameters are given in the form of double assignment "name=name=val". In this case, the assignment is processed twice, first as "name=name=val", and then as "name=val". Due to this double processing, the result becomes "name=name=val:name=val", which exceeds the tunestr buffer size.
Researchers have prepared a stable exploit that allows obtaining root privileges when applied with almost any program that has the suid root flag. Exceptions include the sudo utility (which changes the ELF RUNPATH value), the chage and passwd utilities in Fedora (protected by specific SELinux rules), and the snap-confine utility in Ubuntu (protected by specific AppArmor rules). The proposed exploitation method also does not work in RHEL 8 and RHEL 9, although these branches are vulnerable (an alternative exploit needs to be created for the attack). The exploit code will be published later after the vulnerability has been universally mitigated. You can check your system's vulnerability to this issue using the command below, which will crash if the problem exists: env -i "GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=A" "Z=`printf ‘192x’ 1`" \/usr\/bin\/su —help
It is worth noting the elimination of two more vulnerabilities in Glibc:
- CVE-2023-4806 — a use-after-free memory access in the getaddrinfo() function, which manifests when the NSS plugin only implements the callback calls "_gethostbyname2_r" and "_getcanonname_r", but does not support the call "_gethostbyname3_r". To exploit the vulnerability, the DNS server must return a large number of IPv6 and IPv4 addresses for the requested host, leading to the crash of the process that invoked the getaddrinfo function for the AF_INET6 family with the AI_CANONNAME, AI_ALL, and AI_V4MAPPED flags set.
- CVE-2023-5156 — memory content leakage when invoking the getaddrinfo function for the AF_INET6 address family with the AI_CANONNAME, AI_ALL, and AI_V4MAPPED flags set.
Source: opennet.ru
