{"id":110411,"date":"2023-10-04T08:10:45","date_gmt":"2023-10-04T06:10:45","guid":{"rendered":"https:\/\/prohoster.info\/?p=110411"},"modified":"2023-10-04T08:10:45","modified_gmt":"2023-10-04T06:10:45","slug":"uyazvimost-v-glibc-ld-so-pozvolyayushhaya-poluchit-prava-root-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-glibc-ld-so-pozvolyayushhaya-poluchit-prava-root-v-sisteme","title":{"rendered":"A vulnerability in Glibc ld.so allows obtaining root privileges on the system.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Qualys has identified a critical vulnerability (CVE-2023-4911) in the ld.so loader, which is part of the Glibc (GNU libc) system C library. This vulnerability allows a local user to escalate their privileges by specifying specially crafted data in the GLIBC_TUNABLES environment variable before executing a file with the suid root flag, for example, \/usr\/bin\/su. <\/p>\n

The successful exploitation of this vulnerability has been demonstrated on Fedora 37 and 38, Ubuntu 22.04 and 23.04, Debian 12 and 13. It is believed that the vulnerability also exists in any other distributions using Glibc. Distributions based on the Musl system C library, such as Alpine Linux, are not affected. The vulnerability has been patched as of October 2. Updates for packages in distributions can be tracked on the pages for Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, Gentoo, and ALT Linux. <\/p>\n

The vulnerability is caused by a change made in April 2021, which is part of the glibc 2.34 release. Due to an error in the string parsing code indicated in the GLIBC_TUNABLES environment variable, an incorrect combination of parameters in this variable results in writing the parsed value beyond the allocated buffer. The problem arises when, instead of standard sequences like 'name=val', parameters are specified in the form of double assignment 'name=name=val'. In this case, the assignment is processed twice: first as 'name=name=val', and then as 'name=val'. This double processing results in 'name=name=val:name=val', the size of which exceeds the size of the tunestr buffer. <\/p>\n

Researchers have prepared a reliable exploit that allows gaining root privileges when used with almost any program with the suid root flag. Exceptions include the sudo utility (which alters the ELF RUNPATH value), the chage and passwd utilities in Fedora (which are protected by specific SELinux rules), and the snap-confine utility in Ubuntu (which is protected by specific AppArmor rules). The proposed exploitation method also does not work in RHEL 8 and RHEL 9, although those branches are also vulnerable (requires the creation of a different exploit for the attack). The exploit code will be published later after the vulnerability is addressed universally. To check your system's vulnerability to the issue, you can use the command below, which will crash if the problem exists: env -i 'GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=A' 'Z=`printf '192x' 1`' \/usr\/bin\/su --help <\/p>\n

It is worth noting the elimination of two more vulnerabilities in Glibc: <\/p>\n