Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Three Innocuous Linux Vulnerabilities Chained to Obtain Full Root Privileges

Qualys’ Threat Research Unit has shown how a new Linux vulnerability could be chained with two other apparently harmless flaws to gain full root privileges on an affected system.

Qualys’ Threat Research Unit has shown how a new Linux vulnerability could be chained with two other apparently harmless flaws to gain full root privileges on an affected system.

The new vulnerability, tracked as CVE-2022-3328, is a race condition in Snapd, a Canonical-developed tool used for the Snap software packaging and deployment system. Specifically, the flaw impacts the ‘snap-confine’ program used by Snapd to construct the execution environment for Snap applications.

The affected program is present by default in Ubuntu, whose developers described CVE-2022-3328 as a high-severity flaw that can be exploited for local privilege escalation and arbitrary code execution.

Qualys researchers have shown how CVE-2022-3328 could be combined with other innocuous vulnerabilities for a high-impact attack.

The researchers chained CVE-2022-3328 — this issue was introduced in February 2022 by the patch for a flaw tracked as CVE-2021-44731 — with two recently discovered issues affecting Multipathd. Multipathd is a daemon in charge of checking for failed paths that is running as root in the default installation of Ubuntu and other distributions.

Multipathd is affected by an authorization bypass issue that can be exploited by an unprivileged user to issue privileged commands to Multipathd (CVE-2022-41974), and a symlink attack (CVE-2022-41973) that can be used to force the execution of malicious code.

Chaining the Snapd vulnerability with the two Multipathd flaws can allow any unprivileged user to gain root privileges on a vulnerable device.

“Qualys security researchers have verified the vulnerability, developed an exploit and obtained full root privileges on default installations of Ubuntu,” Qualys said.

Advertisement. Scroll to continue reading.

The vulnerability is not exploitable remotely, but the cybersecurity firm warns that it’s dangerous because it can be exploited by an unprivileged user.

Qualys has made available an advisory containing technical information, but a proof-of-concept (PoC) exploit is not being released at this time.

The US Cybersecurity and Infrastructure Security Agency (CISA) is aware of more than a dozen Linux vulnerabilities that have been exploited in attacks, including a flaw exploited in the wild by a stealthy Linux malware named Shikitega, and the security hole known as PwnKit.

Related: Polkit Vulnerability Provides Root Privileges on Linux Systems

Related: Google Boosts Bug Bounty Rewards for Linux Kernel Vulnerabilities

Related: ‘DirtyCred’ Vulnerability Haunting Linux Kernel for 8 Years

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.