Oh Snapd! Gimme-root-now security bug lets miscreants sock it to your Ubuntu boxes
Canonical has issued an update for Ubuntu to address a security vulnerability that can be exploited by malware and rogue users to gain root access.
As this bug affects desktop and server editions of the Linux distro, this is an irritating flaw for folks using shared systems, such as labs or offices of workstations.
Chris Moberly gets credit for the discovery and reporting of the flaw in question, CVE-2019-7304, which is an elevation-of-privilege vulnerability present in Ubuntu versions prior to 19.04. To reiterate, the flaw is not remotely exploitable, so a miscreant would need to already have a foothold on victim’s machine.
“Current versions [before 19.04] of Ubuntu Linux are vulnerable to local privilege escalation due to a bug in the snapd API. This local service installs by default on both ‘Server’ and ‘Desktop’ versions of Ubuntu and is likely included in many Ubuntu-like Linux distributions,” Moberly said in his report.
“Any local low privilege user can exploit this vulnerability to obtain immediate root access to the server.”
The vulnerability is found in Snapd, Canonical’s open-source toolkit for packaging and running applications via systemd. Exploiting the flaw would allow an attacker to elevate their access from unprivileged process to that of the root user, essentially allowing a complete takeover of the system.
Moberly found that, by abusing the way Snapd’s API handles HTTP data requests, the tool could be tricked into believing the user has a uid of 0, aka the root user. This would let an attacker use functions reserved for the superuser, and eventually take over the box. Rather than being a memory corruption bug – the code in question is written in Go, after all – this is a cockup in handling submitted text.
For those so inclined, Moberly has developed a proof-of-concept script called “dirty sock” that shows how an exploit would operate in the wild.
Canonical has since addressed the flaw, so run your usual package update cycle to get the fix. The snapd tool itself is fixed by updating to version 2.37.1.
Ubuntu users who do install the update should also take a moment to make sure they have updated their versions of Flash Player. Yesterday, Adobe posted a fix for an information disclosure bug as part of its Patch Tuesday dump. ®
READ MORE HERE