{"id":105785,"date":"2022-12-02T15:36:49","date_gmt":"2022-12-02T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap"},"modified":"2022-12-02T15:36:49","modified_gmt":"2022-12-02T13:36:49","slug":"root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap","title":{"rendered":"Root vulnerability in the Snap package management toolkit.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Qualys has identified a third critical vulnerability (CVE-2022-3328) this year in the snap-confine utility, delivered with the SUID root flag and invoked by the snapd process to create an execution environment for applications distributed in self-contained snap packages. The vulnerability allows a local unprivileged user to execute code with root privileges on the default Ubuntu configuration. The issue has been fixed in snapd version 2.57.6. Package updates have been released for all supported Ubuntu branches. <\/p>\n
Interestingly, the vulnerability in question was introduced while fixing a similar vulnerability in snap-confine earlier in February. Researchers were able to prepare a working exploit providing root access on Ubuntu Server 22.04, which also involved two vulnerabilities in the multipathd process (CVE-2022-41974, CVE-2022-41973), associated with bypassing authorization checks during the execution of privileged commands and unsafe handling of symbolic links. <\/p>\n
The vulnerability in snap-confine is caused by a race condition in the must_mkdir_and_open_with_perms() function, added to protect against the replacement of the directory \/tmp\/snap.$SNAP_NAME with a symbolic link at a moment after verifying the owner but before calling the mount system call to bind-mount the directories for the snap package. The added protection involved renaming the directory \/tmp\/snap.$SNAP_NAME to another directory in \/tmp with a random name if it exists and does not belong to the root user. <\/p>\n
During the operation of renaming the directory \/tmp\/snap.$SNAP_NAME, researchers took advantage of the fact that snap-confine also creates the directory \/tmp\/snap.rootfs_XXXXXX for the root of the snap package content. The part 'XXXXXX' in the name is randomly chosen using mkdtemp(), but a package named 'rootfs_XXXXXX' can pass validation in the function sc_instance_name_validate (i.e., the idea is for the name $SNAP_NAME to take the value 'rootfs_XXXXXX', which would then result in the renaming operation overwriting the directory \/tmp\/snap.rootfs_XXXXXX with the root of the snap). <\/p>\n
To achieve simultaneous use of \/tmp\/snap.rootfs_XXXXXX and renaming of \/tmp\/snap.$SNAP_NAME, two instances of snap-confine were launched. As soon as the first instance created \/tmp\/snap.rootfs_XXXXXX, the process was blocked, and the second instance with the package name rootfs_XXXXXX was started, leading to the temporary directory \/tmp\/snap.$SNAP_NAME of the second instance becoming the root directory \/tmp\/snap.rootfs_XXXXXX of the first. Immediately after the renaming, the second instance crashed, and \/tmp\/snap.rootfs_XXXXXX was substituted in a race condition manipulation, similar to the exploitation of the February vulnerability. After the substitution, the execution lock was lifted from the first instance, giving attackers full control over the root directory of the snap. <\/p>\n
At the final stage, a symbolic link \/tmp\/snap.rootfs_XXXXXX\/tmp was created, which was used by the function sc_bootstrap_mount_namespace() for bind-mounting the writable real directory \/tmp into any FS directory, as the mount() call follows symbolic links before mounting. Such mounting is blocked by AppArmor restrictions, but to bypass this block, two auxiliary vulnerabilities in multipathd were exploited. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"