De achtergrondservice gerelateerd aan networkd-dispatcher draait met rootrechten en ontvangt signalen over gebeurtenissen via de D-Bus bus. Informatie over gebeurtenissen gerelateerd aan de statusverandering van netwerkverbindingen wordt verzonden door de systemd-networkd service. Het probleem is dat niet-geprivilegieerde gebruikers een evenement over een niet-bestaande status kunnen genereren en de uitvoering van hun script kunnen initi\u00ebren, dat zal worden uitgevoerd met root-rechten. <\/p>\n
Systemd-networkd is designed to run only system handler scripts located in the \/etc\/networkd-dispatcher directory and not accessible for user replacement. However, due to a vulnerability (CVE-2022-29799) in the file path handling code, there was a possibility of escaping the base directory and executing arbitrary scripts. Specifically, when forming the file path to the script, the values of OperationalState and AdministrativeState passed through D-Bus were used, where special characters were not sanitized. An attacker could generate their own state, with a name containing the characters \"..\\\/\" and redirect the networkd-dispatcher call to another directory. <\/p>\n
The second vulnerability (CVE-2022-29800) is related to a race condition\u2014there was a brief window of time between checking the script parameters (ownership by root) and its execution that was sufficient to replace the file and bypass user root script ownership checks. Additionally, there was a lack of checks for symbolic links in networkd-dispatcher, particularly when executing scripts via subprocess.Popen, which significantly simplified the organization of the attack. <\/p>\n
Gebruikstechniek: <\/p>\n
- \n
- A directory \"\/tmp\/nimbuspwn\" is created, and a symbolic link \"\/tmp\/nimbuspwn\/poc.d\" pointing to the directory \"\/sbin\" is established, which is used to pass the check for executable files owned by root.\n
- For executable files from '\/sbin', files with the same name are created in the directory '\/tmp\/nimbuspwn'. For example, for the file '\/sbin\/vgs', an executable file '\/tmp\/nimbuspwn\/vgs' is created, owned by a non-privileged user, which contains the code that the attacker wishes to execute.\n
- A signal is sent via D-Bus to the networkd-dispatcher process with OperationalState set to the value '...\/..\/tmp\/nimbuspwn\/poc'. To send the signal in the namespace 'org.freedesktop.network1', the ability to connect custom handlers to systemd-networkd was utilized, for example, through manipulations with gpgv or epmd, or it can be benefited from the fact that systemd-networkd is not started by default (for example, in Linux Mint).\n
- After receiving the signal, the Networkd-dispatcher constructs a list of executable files owned by the root user and available in the directory '\/etc\/networkd-dispatcher\/..\/..\/..\/\/tmp\/nimbuspwn\/poc.d', which actually refers to '\/sbin'.\n
- Op het moment dat de lijst met bestanden is ontvangen, maar het script nog niet is gestart, wordt de symbolische link doorgestuurd van «\\\/tmp\\\/nimbuspwn\\\/poc.d» naar «\\\/tmp\\\/nimbuspwn» en zal networkd-dispatcher het script, geplaatst door de aanvaller, met root-rechten uitvoeren. <\/ul>\n
![\"Kwetsbaarheden](\"\/wp-content\/uploads\/2022\/04\/15109315e192eb6384601dfafc436775.jpg\")
<\/center>
\n
Bron: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Microsoft \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-29799, CVE-2022-29800) \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 networkd-dispatcher, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Nimbuspwn \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 networkd-dispatcher 2.2. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u043c\u0438 \u043f\u043e\u043a\u0430 \u043d\u0435\u0442 (Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux). Networkd-dispatcher \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Ubuntu, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":103886,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103885","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kwetsbaarheden in networkd-dispatcher die root-rechten kunnen verkrijgen | ProHoster","description":"Beveiligingsonderzoekers van Microsoft hebben twee kwetsbaarheden (CVE-2022-29799, CVE-2022-29800) ontdekt in de service networkd-dispatcher, gecodeerd als Nimbuspwn, die een niet-geprivilegieerde gebruiker toegang geven.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimosti-v-networkd-dispatcher-pozvolyayushhie-poluchit-prava-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 networkd-dispatcher, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Microsoft \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-29799, CVE-2022-29800) \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0435 networkd-dispatcher, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0435 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Nimbuspwn \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e.","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimosti-v-networkd-dispatcher-pozvolyayushhie-poluchit-prava-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-04-27T13:36:49+00:00","article:modified_time":"2022-04-27T13:36:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103885","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 15:22:48","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-04-27 13:37:05","updated":"2026-02-04 15:22:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/103885","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=103885"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/103885\/revisions"}],"predecessor-version":[{"id":156835,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/103885\/revisions\/156835"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media\/103886"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=103885"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=103885"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=103885"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}