{"id":119929,"date":"2024-09-24T09:43:11","date_gmt":"2024-09-24T07:43:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-pcp-i-nix-pozvolyayushhie-podnyat-privilegii-v-sisteme"},"modified":"2024-09-24T09:43:11","modified_gmt":"2024-09-24T07:43:11","slug":"uyazvimosti-v-pcp-i-nix-pozvolyayushhie-podnyat-privilegii-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-pcp-i-nix-pozvolyayushhie-podnyat-privilegii-v-sisteme","title":{"rendered":"Vulnerabilities in PCP and Nix that allow privilege escalation in the system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Two vulnerabilities have been identified in the PCP (Performance Co-Pilot) toolkit, which is used for collecting system performance statistics (for example, utilized in the Cockpit interface). The first vulnerability (CVE-2024-45770) exists in the pmpost utility, designed for sending messages to the log and, under certain execution conditions, running with elevated privileges. Exploiting this vulnerability allows code execution with root privileges, but to execute the attack, access to the PCP account is necessary. The attack involves replacing the file \u201c\/var\/log\/pcp\/NOTICES\u201d with a symbolic link, allowing writes from the process with root privileges without using the O_NOFOLLOW flag when opening the file. <\/p>\n
The second vulnerability in PCP (CVE-2024-45769) affects the background process pcmd and leads to an out-of-bounds memory access when sending specially crafted data. The risk of this vulnerability is mitigated by the fact that by default pcmd does not accept network requests from other systems. The vulnerabilities have been fixed in the PCP 6.3.1 release. The issues were identified during an audit conducted by developers from the SUSE project. <\/p>\n
Additionally, a vulnerability (CVE-2024-45593) has been identified in the Nix package manager, used in the NixOS distribution. This vulnerability allows for writing to arbitrary areas of the file system during the unpacking of specially crafted files in the NAR (Nix Archive) format, limited by the permissions of the handler being executed (the unpacking process is run as root when using the Nix background process). This issue is present in the Nix 2.24 branch and has been addressed in the 2.24.6 release. <\/p>\n
Additionally, it is worth mentioning the publication of a warning regarding the discovery of a critical vulnerability affecting GNU\/Linux distributions, which allows remote code execution without authentication. Currently, no information is available about the nature of the issue and the subsystems it affects; it is only stated that in coordination with the distribution developers, the initial report on the issue is planned to be published on September 30, and the full report with details on October 6. The CVE for this issue has not yet been assigned. According to the researcher who discovered the problem, Canonical and Red Hat have classified this vulnerability as critical (9.9 out of 10). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"