{"id":106239,"date":"2022-12-22T15:36:49","date_gmt":"2022-12-22T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-systemd-coredump-pozvolyayushhaya-opredelit-soderzhimoe-pamyati-suid-programm"},"modified":"2022-12-22T15:36:49","modified_gmt":"2022-12-22T13:36:49","slug":"uyazvimost-v-systemd-coredump-pozvolyayushhaya-opredelit-soderzhimoe-pamyati-suid-programm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-systemd-coredump-pozvolyayushhaya-opredelit-soderzhimoe-pamyati-suid-programm","title":{"rendered":"A vulnerability in systemd-coredump allows the contents of suid program memory to be determined.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability (CVE-2022-4415) has been identified in the systemd-coredump component, which handles core files generated after process crashes, allowing an unprivileged local user to determine the memory contents of privileged processes running with the suid root flag. The presence of the issue in the default configuration has been confirmed in openSUSE, Arch, Debian, Fedora, and SLES distributions. <\/p>\n
The vulnerability is caused by the lack of proper handling of the sysctl parameter fs.suid_dumpable in systemd-coredump, which, with its default value of 2, enables the generation of core dumps for processes with the suid flag. It is expected that the core files for suid processes, written by the kernel, have access rights that allow reading only by the root user. The systemd-coredump utility, invoked by the kernel to save core files, saves the core file under the root identifier but additionally provides access to core files based on ACL, allowing reading based on the identifier of the owner who originally started the process. <\/p>\n
This feature allows core files to be loaded regardless of whether the program can change its user identifier and run with elevated privileges. The attack involves the user launching a suid application and sending it a SIGSEGV signal, after which they can load the contents of the core file, which includes a snapshot of the process's memory at the time of the crash. <\/p>\n
For example, a user can execute « \/usr\/bin\/su » and in another terminal terminate it using the command « kill -s SIGSEGV `pidof su` », after which systemd-coredump will save the core file in the directory \/var\/lib\/systemd\/coredump, setting an ACL that allows the current user to read it. Since the suid utility ‘su’ reads the content of \/etc\/shadow into memory, an attacker can gain access to the hashed password information of all users in the system. The sudo utility is not vulnerable to this attack because it prevents the generation of core files through ulimit. <\/p>\n
According to the developers of systemd, the vulnerability appears starting with systemd version 247 (November 2020), but according to the researcher who uncovered the issue, version 246 is also affected. The vulnerability occurs if systemd is built with the libacl library (enabled by default in all popular distributions). A fix is currently available as a patch. You can track the fixes in the distributions on the following pages: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Gentoo, Arch. As a workaround, you can set sysctl fs.suid_dumpable to 0, which disables the transfer of dumps to the systemd-coredump handler. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"