{"id":105785,"date":"2022-12-02T15:36:49","date_gmt":"2022-12-02T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap"},"modified":"2022-12-02T15:36:49","modified_gmt":"2022-12-02T13:36:49","slug":"root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap","title":{"rendered":"Vulnerabilitate de tip root \u00een instrumentul de gestionare a pachetelor Snap","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Qualys a identificat a treia vulnerabilitate periculoas\u0103 din acest an (CVE-2022-3328) \u00een utilitarul snap-confine, livrat cu flag-ul SUID root \u0219i apelat de procesul snapd pentru a crea un mediu de execu\u021bie pentru aplica\u021biile distribuite \u00een pachete autonome de tip snap. Vulnerabilitatea permite unui utilizator local f\u0103r\u0103 privilegii s\u0103 ob\u021bin\u0103 execu\u021bia de cod cu drepturi root \u00een configuratia implicit\u0103 a Ubuntu. Problema a fost rezolvat\u0103 \u00een versiunea snapd 2.57.6. Actualiz\u0103rile pachetelor au fost lansate pentru toate ramurile suportate ale Ubuntu. <\/p>\n

Interesant este c\u0103 vulnerabilitatea \u00een cauz\u0103 a fost introdus\u0103 \u00een timpul corect\u0103rii unei vulnerabilit\u0103\u021bi similare din februarie \u00een snap-confine. Cercet\u0103torii au reu\u0219it s\u0103 dezvolte un exploit func\u021bional care ofer\u0103 acces root \u00een Ubuntu Server 22.04, unde, pe l\u00e2ng\u0103 vulnerabilitatea din snap-confine, sunt implicate dou\u0103 vulnerabilit\u0103\u021bi \u00een procesul multipathd (CVE-2022-41974, CVE-2022-41973), legate de ocolirea verific\u0103rii autoriza\u021biilor la transmiterea comenzilor privilegiate \u0219i manipularea nesigur\u0103 a link-urilor simbolice. <\/p>\n

Vulnerabilitatea din snap-confine este cauzat\u0103 de o stare de competi\u021bie \u00een func\u021bia must_mkdir_and_open_with_perms(), ad\u0103ugat\u0103 pentru a proteja \u00eempotriva substitu\u021biei directorului \/tmp\/snap.$SNAP_NAME cu un link simbolic dup\u0103 verificarea proprietarului, dar \u00eenainte de apelul la sistemul de apel mount pentru a efectua montarea bind a directoarelor pentru pachetul \u00een format snap. Protec\u021bia ad\u0103ugat\u0103 consta \u00een redenumirea directorului \/tmp\/snap.$SNAP_NAME \u00eentr-un alt director din \/tmp cu un nume aleator, dac\u0103 acesta exist\u0103 \u0219i nu apar\u021bine utilizatorului root. <\/p>\n

\u00cen timpul opera\u021biei de redenumire a directorului \/tmp\/snap.$SNAP_NAME, cercet\u0103torii au profitat de faptul c\u0103 snap-confine creeaz\u0103 \u0219i un director \/tmp\/snap.rootfs_XXXXXX pentru r\u0103d\u0103cina con\u021binutului pachetului snap. Partea «XXXXXX» din nume este aleas\u0103 aleatoriu folosind mkdtemp(), dar pachetul cu numele «rootfs_XXXXXX» poate trece de verificarea din func\u021bia sc_instance_name_validate (adic\u0103, ideea este ca numele $SNAP_NAME s\u0103 devin\u0103 «rootfs_XXXXXX» \u0219i atunci opera\u021bia de redenumire va duce la suprascrierea directorului \/tmp\/snap.rootfs_XXXXXX cu r\u0103d\u0103cina snap). <\/p>\n

Pentru a permite utilizarea simultan\u0103 a \/tmp\/snap.rootfs_XXXXXX \u0219i redenumirea \/tmp\/snap.$SNAP_NAME, au fost lansate dou\u0103 instan\u021be de snap-confine. C\u00e2nd prima instan\u021b\u0103 crea \/tmp\/snap.rootfs_XXXXXX, procesul se bloca \u0219i se lansa cea de-a doua instan\u021b\u0103 cu numele de pachet rootfs_XXXXXX, ceea ce ducea la faptul c\u0103 directorul temporar \/tmp\/snap.$SNAP_NAME al celei de-a doua instan\u021be devenea directorul r\u0103d\u0103cin\u0103 \/tmp\/snap.rootfs_XXXXXX al primei. Imediat dup\u0103 finalizarea redenumirii, a doua instan\u021b\u0103 se \u00eenchidea brusc, iar \/tmp\/snap.rootfs_XXXXXX era substituit prin manipularea unei condi\u021bii de curs\u0103, similar exploat\u0103rii vulnerabilit\u0103\u021bii din februarie. Dup\u0103 aceast\u0103 substituire, prima instan\u021b\u0103 \u00ee\u0219i relua execu\u021bia, iar atacatorii dob\u021bineau control total asupra directorului r\u0103d\u0103cin\u0103 snap. <\/p>\n

\u00cen ultima etap\u0103, se crea un link simbolic \/tmp\/snap.rootfs_XXXXXX\/tmp, care era utilizat de func\u021bia sc_bootstrap_mount_namespace() pentru a monta bind un director real, scriitor \/tmp \u00een orice director FS, deoarece apelul mount() urmeaz\u0103 link-urile simbolice \u00eenainte de montare. O asemenea montare este blocat\u0103 de restric\u021biile AppArmor, dar pentru a o ocoli, \u00een exploit au fost folosite dou\u0103 vulnerabilit\u0103\u021bi auxiliare \u00een multipathd.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0442\u0440\u0435\u0442\u044c\u044e \u0432 \u044d\u0442\u043e\u043c\u0443 \u0433\u043e\u0434\u0443 \u043e\u043f\u0430\u0441\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-3328) \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 snap-confine, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c SUID root \u0438 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u043c snapd \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u0441\u0430\u043c\u043e\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 snap. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 Ubuntu \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105785","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate de tip root \u00een instrumentele de gestionare a pachetelor Snap | ProHoster","description":"Compania Qualys a identificat a treia vulnerabilitate critic\u0103 a anului (CVE-2022-3328) \u00een utilitarul snap-confine, livrat cu flag-ul SUID root \u0219i invocat de procesul snapd pentru a forma mediu de execu\u021bie pentru.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Root-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 Snap | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0442\u0440\u0435\u0442\u044c\u044e \u0432 \u044d\u0442\u043e\u043c\u0443 \u0433\u043e\u0434\u0443 \u043e\u043f\u0430\u0441\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-3328) \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 snap-confine, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c SUID root \u0438 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u043c snapd \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0434\u043b\u044f.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/root-uyazvimost-v-instrumentarii-upravleniya-paketami-snap","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-12-02T13:36:49+00:00","article:modified_time":"2022-12-02T13:36:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/105785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=105785"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/105785\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=105785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=105785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=105785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}