Microsoft security researchers have identified two vulnerabilities (CVE-2022-29799, CVE-2022-29800) in the networkd-dispatcher service, code-named Nimbuspwn, which allow an unprivileged user to execute arbitrary commands with root privileges. The issue has been resolved in the networkd-dispatcher 2.2 release. There is currently no information regarding the release of updates by distributions (Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux).
Networkd-dispatcher is used in many Linux distributions, including Ubuntu, that utilize the systemd-networkd background process for configuring network parameters. It performs functions similar to NetworkManager-dispatcher, i.e., it is responsible for executing scripts when the state of the network connection changes, for example, it is used to launch VPN after establishing the primary network connection.
The background process related to networkd-dispatcher runs with root privileges and receives event signals via the D-Bus bus. Event information regarding changes in the state of network connections is sent by the systemd-networkd service. The issue is that unprivileged users can generate an event for a non-existent state and initiate the execution of their script, which will be run with root privileges.
Systemd-networkd is designed to run only system handler scripts located in the /etc/networkd-dispatcher directory that are not user-replaceable, but due to the vulnerability (CVE-2022-29799) in the file path processing code, there was a possibility of escaping the base directory and executing arbitrary scripts. Specifically, when forming the file path to the script, the passed values of OperationalState and AdministrativeState via D-Bus were used without sanitizing special characters. An attacker could generate their own state, in the name of which there were characters "..\/" and redirect the networkd-dispatcher call to another directory.
The second vulnerability (CVE-2022-29800) relates to a race condition—there was a small time window between checking the script parameters (root ownership) and its execution, sufficient to replace the file and bypass the check for the script's ownership by the root user. Additionally, networkd-dispatcher lacked checks for symbolic links, including when executing scripts via subprocess.Popen, significantly simplifying the organization of the attack.
Operating Technique:
- A directory "/tmp/nimbuspwn" and a symbolic link "/tmp/nimbuspwn/poc.d" pointing to the directory "/sbin" are created, which is used to perform the check for executable files owned by root.
- For the executable files from "/sbin", files with the same name are created in the directory "/tmp/nimbuspwn"; for example, for the file "/sbin/vgs", an executable file "/tmp/nimbuspwn/vgs" is created, owned by a non-privileged user, which contains the code that the attacker wishes to execute.
- Through D-Bus, the process networkd-dispatcher sends a signal indicating in OperationalState the value "../..../tmp/nimbuspwn/poc". The ability to attach custom handlers to systemd-networkd was used to send the signal in the namespace "org.freedesktop.network1", for example, through manipulations with gpgv or epmd, or one can take advantage of the fact that systemd-networkd is not running by default (for instance, in Linux Mint).
- After receiving the signal, Networkd-dispatcher builds a list of executable files owned by root and available in the directory "/etc/networkd-dispatcher/../../../tmp/nimbuspwn/poc.d", which in reality refers to "/sbin".
- At the moment the list of files is obtained, but the script has not yet been executed, the symbolic link is redirected from "/tmp/nimbuspwn/poc.d" to "/tmp/nimbuspwn", and networkd-dispatcher will execute the script placed by the attacker with root privileges.
Source: opennet.ru
