Qualys has identified a dangerous vulnerability (CVE-2023-6246) in the standard C library Glibc, allowing code execution with elevated privileges through manipulation of SUID application launches. Researchers have developed a working exploit that enables root access by manipulating command line arguments when launching the su utility.
The vulnerability is caused by a buffer overflow in the __vsyslog_internal() function, used during calls to the syslog() and vsyslog() functions. The issue arises from an error attempting to output an overly long application name via the SYSLOG_HEADER macro. When trying to extend the buffer to accommodate the long name, a failure occurs, after which data is written to the older buffer of originally smaller size.
When conducting an attack through the su utility, an attacker can change the process name when launching an application by altering the value of argv[0], which is used to obtain information about the program name when logging. This allows for controlled overwriting of data beyond the allocated buffer. The overflow can then be used to overwrite the nss_module structure in the nss library to create a shared library and load it with root privileges.
The problem has been present since the release of glibc 2.37, published in August 2022, which included a change to handle situations where oversized messages were attempted to be written. The vulnerability-introducing fix was backported into the glibc 2.36 branch and distribution packages with older versions of glibc, as the noted fix addressed the vulnerability CVE-2022-39046, leading to heap data leakage. Thus, the fix for a non-critical vulnerability led to a significant issue. Notably, a similar vulnerability in the vsyslog() function of the libc library version 5.4.3 was reported as early as 1997.
The vulnerability has been confirmed in Debian 12/13, Ubuntu 23.04/23.10, and Fedora 37-39. The exploit's ability to grant root privileges to an unprivileged user has been demonstrated in a fully updated Fedora 38 environment with all default security mechanisms enabled. The vulnerability can only be exploited locally, as it requires the transmission of more than 1024 bytes through the argv[0] parameter or the ident argument in the openlog() function.
The vulnerability fix was integrated into the Glibc codebase several hours ago and will be included in tomorrow's Glibc 2.39 update, along with fixes for two other vulnerabilities (CVE-2023-6779, CVE-2023-6780), which also affect the __vsyslog_internal() code and lead to buffer overflows. Moreover, Qualys has warned about a buffer overflow identified in the implementation of the qsort() function, which the Glibc developers did not classify as a vulnerability, as its exploitation requires using an atypical comparison function as an argument when calling qsort that returns the difference between the compared parameters.
The status of vulnerability mitigation in the distributions can be assessed on the following pages: Debian, Ubuntu, SUSE, RHEL, Fedora, Arch Linux, Gentoo, Slackware. The system's susceptibility to the vulnerability can be tested with the following command: $ (exec -a "`printf '28000x' 1`" /usr/bin/su < /dev/null)
Source: opennet.ru
