Now-patched Ubuntu desktop vulnerability allows privilege escalation
(2020/11/11)
- Reference: 1605102250
- News link: https://www.theregister.co.uk/2020/11/11/ubuntu_desktop_vulnerability_allows_privilege/
- Source link:
GitHub security researcher Kevin Backhouse found bugs in Ubuntu 20.04 (a long-term support release) which enabled any desktop user to get root access. The vulnerabilities have now been patched.
Backhouse [1]discovered two separate issues, one by accident, which together enable the privilege escalation. He noted that the vulnerability is a basic one. “It's unusual for a vulnerability on a modern operating system to be this easy to exploit. I have, on some occasions, written thousands of lines of code to exploit a vulnerability,” he said.
The first part is an attack which exploits AccountsService, a daemon which manages user accounts. This comes from the freedesktop project but is modified by Ubuntu’s developers to read a file in the user’s home directory.
Pointing this file to /dev/zero (a special location which returns an infinite string of null characters) via a symbolic link makes the service hang. When reading the file, AccountsService drops to user privileges as a security precaution, with the unfortunate side-effect that the user can kill the process.
This enables the second part of the attack, which uses a component of the Gnome desktop that triggers system setup when there are no user accounts. If the AccountsService is unresponsive, the component thinks it is setup time and launches dialogs that enable the creation of a new user with root privileges.
The Ubuntu AccountsService issue was fixed [2]here on November 3rd, and the Gnome Desktop issue was patched a day later as reported [3]here .
Backhouse discovered the AccountsService issue while looking for security vulnerabilities, but the ability to create a new account was found by accident, after triggering the first problem.
The vulnerability only impacts desktop users, and requires access to the GUI, so it is not easy to exploit in most scenarios. That said, Ubuntu Server could in principle be vulnerable if the desktop is installed and a user has some level of access. According to the Ubuntu notes, all releases from 16.04 LTS to the recent [4]20.10 are affected.
Although Backhouse said that this exploit is particularly easy to execute, he added that he does not want “to give you impression that Ubuntu is full of trivial security bugs; that’s not been my impression so far.”
Linux is most popular though as a server operating system so it is possible that the desktop components have been subject to less scrutiny.
All in all, more good reasons to keep systems patched and not to install a GUI on a server. ®
Get our [5]Tech Resources
[1] https://securitylab.github.com/research/Ubuntu-gdm3-accountsservice-LPE
[2] https://ubuntu.com/security/notices/USN-4616-1
[3] https://gitlab.gnome.org/GNOME/gdm/-/issues/642
[4] https://www.theregister.com/2020/10/23/ubuntu_2010_goes_full_raspberry/
[5] https://whitepapers.theregister.com/
Backhouse [1]discovered two separate issues, one by accident, which together enable the privilege escalation. He noted that the vulnerability is a basic one. “It's unusual for a vulnerability on a modern operating system to be this easy to exploit. I have, on some occasions, written thousands of lines of code to exploit a vulnerability,” he said.
The first part is an attack which exploits AccountsService, a daemon which manages user accounts. This comes from the freedesktop project but is modified by Ubuntu’s developers to read a file in the user’s home directory.
Pointing this file to /dev/zero (a special location which returns an infinite string of null characters) via a symbolic link makes the service hang. When reading the file, AccountsService drops to user privileges as a security precaution, with the unfortunate side-effect that the user can kill the process.
This enables the second part of the attack, which uses a component of the Gnome desktop that triggers system setup when there are no user accounts. If the AccountsService is unresponsive, the component thinks it is setup time and launches dialogs that enable the creation of a new user with root privileges.
The Ubuntu AccountsService issue was fixed [2]here on November 3rd, and the Gnome Desktop issue was patched a day later as reported [3]here .
Backhouse discovered the AccountsService issue while looking for security vulnerabilities, but the ability to create a new account was found by accident, after triggering the first problem.
The vulnerability only impacts desktop users, and requires access to the GUI, so it is not easy to exploit in most scenarios. That said, Ubuntu Server could in principle be vulnerable if the desktop is installed and a user has some level of access. According to the Ubuntu notes, all releases from 16.04 LTS to the recent [4]20.10 are affected.
Although Backhouse said that this exploit is particularly easy to execute, he added that he does not want “to give you impression that Ubuntu is full of trivial security bugs; that’s not been my impression so far.”
Linux is most popular though as a server operating system so it is possible that the desktop components have been subject to less scrutiny.
All in all, more good reasons to keep systems patched and not to install a GUI on a server. ®
Get our [5]Tech Resources
[1] https://securitylab.github.com/research/Ubuntu-gdm3-accountsservice-LPE
[2] https://ubuntu.com/security/notices/USN-4616-1
[3] https://gitlab.gnome.org/GNOME/gdm/-/issues/642
[4] https://www.theregister.com/2020/10/23/ubuntu_2010_goes_full_raspberry/
[5] https://whitepapers.theregister.com/
Re: GUI on a server?
Dom 3
Webmin.
Cynic_999
I should think that in most (or at least many) cases, the only people who have physical access to a company's server desktop GUI would be those with legitimate admin logins. For Ubuntu workstations, as it can only be exploited by people with user logins and physical access to the screen & keyboard (or maybe a GUI remote access session such as "Team Viewer"?), it is perhaps not as serious as it may appear at first read.
Very good catch!
GUI on a server?
Honesty GUIs on Servers wouldn't be a problem if they were specific to use as a Server and nothing else.
But no, we cannot have that. Using a Server must be an Arcane art of text commands like it was the seventies.