V , implementation of the NTP protocol used for time synchronization in various Linux distributions, ranljivost (), allowing the overwriting of any file in the system with access to a local unprivileged user chrony. The vulnerability can only be exploited through the chrony user, which reduces its danger. However, the issue compromises the isolation level in chrony and can be used if another vulnerability in the code executed after privilege drop is detected.
The vulnerability is caused by insecure creation of the pid file, which was created at the stage when chrony has not yet dropped privileges and is running with root rights. The directory /run/chrony, where the pid file is written, was created with 0750 rights via systemd-tmpfiles or when starting chronyd bound to the user and group 'chrony'. Thus, if access to chrony user is available, there is an opportunity to replace the pid-file /run/chrony/chronyd.pid with a symbolic link. The symbolic link can point to any system file that will be overwritten at the moment of launching chronyd.
root# systemctl stop chronyd.service
root# sudo -u chrony /bin/bash
chrony$ cd /run/chrony
chrony$ ln -s /etc/shadow chronyd.pid
chrony$ exit
root# /usr/sbin/chronyd -n
^C
# вместо содержимого /etc/shadow будет сохранён идентификатор процесса chronyd
root# cat /etc/shadow
15287
Ranljivost in the release . Package updates resolving the vulnerability are available for . In preparation of the update for , in .
SUSE and openSUSE the issue , as the symbolic link for chrony is created directly in the /run directory, without the application of additional subdirectories.
Izvor: opennet.ru
