Company Qualys has discovered a dangerous vulnerability (CVE-2023-4911) in the ld.so linker provided with the standard C library Glibc (GNU libc). This vulnerability allows a local user to escalate their privileges on the system by setting specially crafted data in the GLIBC_TUNABLES environment variable before executing a file with the suid root flag, for example, /usr/bin/su.
The successful exploitation of the vulnerability has been demonstrated in Fedora 37 and 38, Ubuntu 22.04 and 23.04, Debian 12 and 13. It is presumed that the vulnerability is present in any other distributions using Glibc. Distributions based on the Musl C library, such as Alpine Linux, are not affected. The vulnerability has been patched in an update released on October 2. Updates for packages in distributions can be tracked on the pages of Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora, Arch, Gentoo, ALT Linux.
The vulnerability was caused by a change made in April 2021 that was included in the release of glibc 2.34. Due to an error in the string parsing code specified in the GLIBC_TUNABLES environment variable, an incorrect combination of parameters in this variable leads to writing the parsed value beyond the allocated buffer. The problem occurs when instead of the standard sequences "name=val", parameters are specified in the form with double assignment "name=name=val". In this case, the assignment is processed twice, first as "name=name=val", and then as "name=val". Due to such double processing, the result "name=name=val:name=val" is formed, which exceeds the tunestr buffer size.
Raziskovalci so pripravili stabilno delujoči exploit, ki omogoča pridobitev pravic root pri uporabi praktično katere koli aplikacije s flagom suid root. Izjema sta orodje sudo (spreminja vrednost ELF RUNPATH), orodji chage in passwd v Fedora (z zaščitnimi pravili SELinux) ter orodje snap-confine v Ubuntu (z zaščitnimi pravili AppArmor). Predlagana metoda izkoriščanja prav tako ne deluje v RHEL 8 in RHEL 9, čeprav so ti sistemi ranljivi (za napad je potrebna ustvaritev drugega exploita). Koda exploita bo objavljena kasneje, po splošni odpravi ranljivosti. Preverite, ali je vaš sistem ranljiv, s spodnjo ukazno vrstico, ki se bo ob prisotnosti težave končala s crashom: env -i "GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=A" "Z=`printf ‘192x’ 1`" \/usr\/bin\/su —help
Zaznamuje se odprava še dveh ranljivosti v Glibc:
- CVE-2023-4806 — dostop do že osvobojene pomnilniške površine (use-after-free) v funkciji getaddrinfo(), ki se manifestira, ko NSS-vtičnik izvaja samo klicne povratne klice „_gethostbyname2_r“ in „_getcanonname_r“, vendar ne podpira klica „_gethostbyname3_r“. Za izkoriščanje ranljivosti mora DNS strežnik vrniti za zahtevano gostiteljsko ime veliko število naslovov IPv6 in IPv4, kar bo povzročilo sesutje procesa, ki je poklical funkcijo getaddrinfo za družino AF_INET6 pri nastavljanju oznak AI_CANONNAME, AI_ALL in AI_V4MAPPED.
- CVE-2023-5156 — uhajanje vsebine pomnilnika pri klicu funkcije getaddrinfo za družino naslovov AF_INET6 z nastavljenimi oznakami AI_CANONNAME, AI_ALL in AI_V4MAPPED.
Izvor: opennet.ru
