{"id":103885,"date":"2022-04-27T15:36:48","date_gmt":"2022-04-27T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-networkd-dispatcher-pozvolyayushhie-poluchit-prava-root"},"modified":"2022-04-27T15:36:48","modified_gmt":"2022-04-27T13:36:49","slug":"uyazvimosti-v-networkd-dispatcher-pozvolyayushhie-poluchit-prava-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-v-networkd-dispatcher-pozvolyayushhie-poluchit-prava-root","title":{"rendered":"Sebezhet\u0151s\u00e9gek a networkd-dispatcher-ben, amelyek lehet\u0151v\u00e9 teszik a root jogok megszerz\u00e9s\u00e9t","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Microsoft security researcher discovered two vulnerabilities (CVE-2022-29799, CVE-2022-29800) in the networkd-dispatcher service, codenamed Nimbuspwn, which allow an unprivileged user to execute arbitrary commands with root privileges. The issue has been fixed in networkd-dispatcher version 2.2. No information is yet available about the release of updates by distributions (Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux). <\/p>\n

Networkd-dispatcher is used in many Linux distributions, including Ubuntu, which uses the systemd-networkd background process to configure network parameters, and performs functions similar to the NetworkManager-dispatcher, i.e., it is responsible for running scripts when the state of a network connection changes, for example, it's used to start VPN<\/a> after establishing the main network connection. <\/p>\n

The background process related to networkd-dispatcher runs with root privileges and receives event signals via the D-Bus bus. Information about events related to changes in the state of network connections is sent by the systemd-networkd service. The problem is that unprivileged users can generate an event of a non-existent state and initiate the execution of their script, which will be run with root privileges. <\/p>\n

A Systemd-networkd a rendszerforr\u00e1skezel\u0151 szkriptek futtat\u00e1s\u00e1ra lett tervezve, amelyek a \"\/etc\/networkd-dispatcher\" k\u00f6nyvt\u00e1rban tal\u00e1lhat\u00f3k, \u00e9s nem cser\u00e9lhet\u0151k felhaszn\u00e1l\u00f3i szkriptekre. Azonban egy s\u00e9r\u00fcl\u00e9kenys\u00e9g (CVE-2022-29799) miatt a f\u00e1jlok el\u00e9r\u00e9si \u00fatj\u00e1nak feldolgoz\u00f3 k\u00f3dj\u00e1ban lehet\u0151s\u00e9g ny\u00edlt a k\u00f6nyvt\u00e1ron k\u00edv\u00fcl es\u0151 szkriptek futtat\u00e1s\u00e1ra. K\u00fcl\u00f6n\u00f6sen, a szkriptek el\u00e9r\u00e9si \u00fatj\u00e1nak kialak\u00edt\u00e1sakor a D-Bus-on kereszt\u00fcl \u00e1tadott OperationalState \u00e9s AdministrativeState \u00e9rt\u00e9keket haszn\u00e1lt\u00e1k, amelyekben nem v\u00e9geztek k\u00fcl\u00f6nb\u00f6z\u0151 karaktertiszt\u00edt\u00e1st. A t\u00e1mad\u00f3 l\u00e9trehozhatott egy saj\u00e1t \u00e1llapotot, amely tartalmazta a \"..\/\" karaktereket, \u00e9s \u00e1tir\u00e1ny\u00edthatta a networkd-dispatcher h\u00edv\u00e1s\u00e1t egy m\u00e1sik k\u00f6nyvt\u00e1rba. <\/p>\n

A m\u00e1sodik s\u00e9r\u00fcl\u00e9kenys\u00e9g (CVE-2022-29800) egy versenyhelyzettel kapcsolatos \u2014 a szkriptek param\u00e9tereinek ellen\u0151rz\u00e9se (roothoz val\u00f3 tartoz\u00e1s) \u00e9s a szkript futtat\u00e1sa k\u00f6z\u00f6tt volt egy kis id\u0151intervallum, amely elegend\u0151 volt a f\u00e1jl kicser\u00e9l\u00e9s\u00e9re \u00e9s a szkript root jogosults\u00e1g ellen\u0151rz\u00e9s\u00e9nek megker\u00fcl\u00e9s\u00e9re. Ezenk\u00edv\u00fcl a networkd-dispatcher nem ellen\u0151rizte a szimbolikus linkeket, bele\u00e9rtve a subprocess.Popen h\u00edv\u00e1sokon kereszt\u00fcl futtatott szkriptek eset\u00e9t is, ami nagyban megk\u00f6nny\u00edtette a t\u00e1mad\u00e1s lebonyol\u00edt\u00e1s\u00e1t. <\/p>\n

M\u0171k\u00f6d\u00e9si technika: <\/p>\n