In the Enlightenment user environment, a vulnerability (CVE-2022-37706) has been identified, allowing an unprivileged local user to execute code with root privileges. The vulnerability has not yet been patched (0-day), but an exploit has already been publicly available and tested on Ubuntu 22.04.
The issue exists in the enlightenment_sys executable, which is provided with the suid root flag and executes certain permitted commands via the system() call, such as mounting a storage device using the mount utility. Due to incorrect functioning of the function that constructs the string passed to the system() call, quotation marks are stripped from the arguments of the executed command, which can be exploited to run arbitrary code. For instance, executing mkdir -p /tmp/net mkdir -p '/tmp/;/tmp/exploit' echo '/bin/sh' > /tmp/exploit chmod a+x /tmp/exploit enlightenment_sys /bin/mount -o noexec,nosuid,utf8,nodev,iocharset=utf8,utf8=0,utf8=1,uid=$(id -u), '/dev/../tmp/;/tmp/exploit' /tmp///net.
Due to the stripping of double quotation marks, instead of the specified command '/bin/mount ... '/dev/../tmp/;/tmp/exploit' /tmp///net', the string without double quotation marks '/bin/mount ... /dev/../tmp/;/tmp/exploit /tmp///net' will be passed to the system() function, leading to the separate execution of the command '/tmp/exploit /tmp///net' instead of processing it as part of the device path. The strings '/dev/../tmp/' and '/tmp///net' are crafted to bypass the argument checks of the mount command in enlightenment_sys (the mount device must start with /dev/ and point to an existing file, and the three '/' characters in the mount point are specified to meet the required path length).
Source: opennet.ru
