Qualys’ Threat Research Unit has shown how a new Linux vulnerability could be chained with two other apparently harmless flaws to gain full root privileges on an affected system.
The new vulnerability, tracked as CVE-2022-3328, is a race condition in Snapd, a Canonical-developed tool used for the Snap software packaging and deployment system. Specifically, the flaw impacts the ‘snap-confine’ program used by Snapd to construct the execution environment for Snap applications.
The affected program is present by default in Ubuntu, whose developers described CVE-2022-3328 as a high-severity flaw that can be exploited for local privilege escalation and arbitrary code execution.
Qualys researchers have shown how CVE-2022-3328 could be combined with other innocuous vulnerabilities for a high-impact attack.
The researchers chained CVE-2022-3328 — this issue was introduced in February 2022 by the patch for a flaw tracked as CVE-2021-44731 — with two recently discovered issues affecting Multipathd. Multipathd is a daemon in charge of checking for failed paths that is running as root in the default installation of Ubuntu and other distributions.
Multipathd is affected by an authorization bypass issue that can be exploited by an unprivileged user to issue privileged commands to Multipathd (CVE-2022-41974), and a symlink attack (CVE-2022-41973) that can be used to force the execution of malicious code.
Chaining the Snapd vulnerability with the two Multipathd flaws can allow any unprivileged user to gain root privileges on a vulnerable device.
“Qualys security researchers have verified the vulnerability, developed an exploit and obtained full root privileges on default installations of Ubuntu,” Qualys said.
The vulnerability is not exploitable remotely, but the cybersecurity firm warns that it’s dangerous because it can be exploited by an unprivileged user.
Qualys has made available an advisory containing technical information, but a proof-of-concept (PoC) exploit is not being released at this time.
The US Cybersecurity and Infrastructure Security Agency (CISA) is aware of more than a dozen Linux vulnerabilities that have been exploited in attacks, including a flaw exploited in the wild by a stealthy Linux malware named Shikitega, and the security hole known as PwnKit.
Related: Polkit Vulnerability Provides Root Privileges on Linux Systems
Related: Google Boosts Bug Bounty Rewards for Linux Kernel Vulnerabilities
Related: ‘DirtyCred’ Vulnerability Haunting Linux Kernel for 8 Years
