Networkd-dispatcheriga seotud taustaprotsess t\u00f6\u00f6tab root \u00f5igustes ja v\u00f5tab s\u00fcndmuste signaale D-Bus'i bussilt. Informatsioon v\u00f5rgu\u00fchenduse seisundite muutumise s\u00fcndmuste kohta edastatakse teenuse systemd-networkd kaudu. Probleem on selles, et mittet\u00e4ielikud kasutajad saavad genereerida mitteeksisteeriva oleku s\u00fcndmuse ja algatada oma skripti k\u00e4ivitamise, mis toimub root \u00f5igustes. <\/p>\n
Systemd-networkd on m\u00f5eldud k\u00e4ivitama ainult s\u00fcsteemseid t\u00f6\u00f6tlemisskripte, mis asuvad kataloogis \/etc\/networkd-dispatcher ja ei ole kasutaja poolt asendatavad, kuid haavatavuse (CVE-2022-29799) t\u00f5ttu failitee t\u00f6\u00f6tlemise koodis oli v\u00f5imalus v\u00e4ljuda p\u00f5hikataloogist ja k\u00e4ivitada suvalisi skripte. Eriti \u00fcldiselt failitee loomisel kasutati D-Bus'i kaudu edastatud v\u00e4\u00e4rtusi OperationalState ja AdministrativeState, kus erim\u00e4rkide puhastamist ei tehtud. R\u00fcndaja suutis genereerida oma oleku, mille nimes olid t\u00e4hem\u00e4rgid \u00ab..\/\u00bb ja suunata networkd-dispatcheri p\u00e4ring teise kataloogi. <\/p>\n
Teine haavatavus (CVE-2022-29800) on seotud v\u00f5istlusolukorraga \u2014 skripti parameetrite kontrollimise (omamine root'i) ja selle k\u00e4ivitamise vahel oli v\u00e4ike ajavahemik, piisav, et faili asendada ja m\u00f6\u00f6da minna kontrollist skripti kasutaja root'i kuuluvuse osas. Lisaks puudus networkd-dispatcheris s\u00fcmboolsete linkide kontroll, sealhulgas skripte k\u00e4ivitades subprocess.Popen'i k\u00e4ivitusel, mis oluliselt lihtsustas r\u00fcnnaku korraldamist. <\/p>\n
R\u00fcnnakutehnika: <\/p>\n
- \n
- Luues katalooge \u00ab\/tmp\/nimbuspwn\u00bb ja s\u00fcmboolset linki \u00ab\/tmp\/nimbuspwn\/poc.d\u00bb, mis osutab kataloogile \u00ab\/sbin\u00bb, mille kaudu kontrollitakse, kas esinevad root'ile kuuluvad t\u00e4idetavad failid.\n
- Kataloogis \u00ab\/tmp\/nimbuspwn\u00bb luuakse analoogse nimega faile t\u00e4idetavate failide jaoks, mis asuvad \u00ab\/sbin\u00bb, n\u00e4iteks failile \u00ab\/sbin\/vgs\u00bb luuakse t\u00e4idetav fail \u00ab\/tmp\/nimbuspwn\/vgs\u00bb, mis kuulub mitterikkale kasutajale, kuhu r\u00fcndaja soovib paigutada koodi, mida k\u00e4ivitada.\n
- D-Bus'is saadetakse networkd-dispatcher'ile signaal, mille OperationalState'i v\u00e4\u00e4rtuses on \u00ab..\/..\/..\/tmp\/nimbuspwn\/poc\u00bb. Signaali edastamiseks ruumis \u00aborg.freedesktop.network1\u00bb kasutati v\u00f5imalust liita oma k\u00e4sitlejad systemd-networkd'ga, n\u00e4iteks l\u00e4bi gpgv v\u00f5i epmd manipuleerimise, v\u00f5i saab kasutada seda, et systemd-networkd ei k\u00e4ivitata vaikimisi (n\u00e4iteks Linux Mintis).\n
- P\u00e4rast signaali saamist koostab Networkd-dispatcher loendi t\u00e4idetavatest failidest, mis kuuluvad root'ile ja on saadaval kataloogis \u00ab\/etc\/networkd-dispatcher\/..\/..\/..\/tmp\/nimbuspwn\/poc.d\u00bb, mis tegelikult viitab \u00ab\/sbin\u00bb.\n
- Hetkel, kui failide loend on saadud, kuid skripti pole veel k\u00e4ivitatud, suunatakse s\u00fcmboolne link «\\\/tmp\\\/nimbuspwn\\\/poc.d» aadressile «\\\/tmp\\\/nimbuspwn» ning networkd-dispatcher k\u00e4ivitab skripti, mis on r\u00fcndaja poolt paigutatud, root \u00f5igustes. <\/ul>\n
![\"Ohutusprobleemid](\"\/wp-content\/uploads\/2022\/04\/15109315e192eb6384601dfafc436775.jpg\")
<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Microsoft \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-29799, CVE-2022-29800) \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 networkd-dispatcher, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Nimbuspwn \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 networkd-dispatcher 2.2. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u043c\u0438 \u043f\u043e\u043a\u0430 \u043d\u0435\u0442 (Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux). Networkd-dispatcher \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Ubuntu, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":103886,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103885","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vead networkd-dispatcheris, mis v\u00f5imaldavad saada root-\u00f5igusi | ProHoster","description":"Microsofti k\u00fcberturbeuurijad tuvastasid teenuses networkd-dispatcher kaks haavatavust (CVE-2022-29799, CVE-2022-29800), mille koodnimi on Nimbuspwn ja mis v\u00f5imaldavad mitteprivilegeeritud kasutajal access saada.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-networkd-dispatcher-pozvolyayushhie-poluchit-prava-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 networkd-dispatcher, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Microsoft \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-29799, CVE-2022-29800) \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 networkd-dispatcher, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Nimbuspwn \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-networkd-dispatcher-pozvolyayushhie-poluchit-prava-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-04-27T13:36:49+00:00","article:modified_time":"2022-04-27T13:36:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103885","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 15:22:48","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-04-27 13:37:05","updated":"2026-02-04 15:22:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103885","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=103885"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103885\/revisions"}],"predecessor-version":[{"id":156835,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103885\/revisions\/156835"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/103886"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=103885"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=103885"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=103885"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}