Flaws in networkd-dispatcher, a service used in some parts of the Linux world, can be exploited by a rogue logged-in user or application to escalate their privileges to root level, allowing the box to be commandeered, Microsoft researchers said Wednnesday.

It's nice of Redmond to point out these flaws and have them fixed in any affected distributions; the US tech giant is a big user of Linux and relies on the open-source OS throughout its empire. It's just a little perplexing the biz went to [1]all the effort of a big write-up and giving the flaws a catchy name, Nimbuspwn, when countless privilege-elevation holes are fixed in the Windows operating system each month, and we can't recall Microsoft lately making this much of a song and dance over them.

"The growing number of vulnerabilities on Linux environments emphasize the need for strong monitoring of the platform's operating system and its components," wrote Jonathan Bar Or of the Microsoft 365 Defender Research Team, which, again, is perhaps a bit rich for the Windows goliath to bring up.

[2]

It's not that Linux doesn't have security vulnerabilities – it has plenty, and they ought to be publicized – it's just that glasshouses and stones come to mind. If you're using a vulnerable Linux distro, grab its latest updates to patch the flaw. It appears networkd-dispatcher was updated three weeks ago, to [3]version 2.2 , to close the holes.

[4]

[5]

Microsoft said it spotted the vulnerabilities – now tracked as [6]CVE-2022-29799 and [7]CVE-2022-29800 – while performing code reviews and dynamic analysis on services that run as root. We're told that analysts noticed an "odd pattern" in [8]networkd-dispatcher , an open-source tool that can be used to detect and act on connection status changes.

The security weaknesses uncovered in the review included insecure directory traversal, symlink races, and time-of-check-time-of-use race conditions, which can be exploited to elevate one's privileges, allowing them to deploy malware or perform other malicious activities through arbitrary root code execution.

[9]

"Moreover, the Nimbuspwn vulnerabilities could potentially be leveraged as a vector for root access by more sophisticated threats, such as malware or ransomware, to achieve greater impact on vulnerable devices," Bar Or wrote.

All three vulnerabilities were found by following the flow of execution to a _run_hooks_for_state method, which is responsible for finding and running scripts. With the time-of-check-time-of-use race condition, "there is a certain time between the scripts being discovered and them being run," he wrote. "An attacker can abuse this vulnerability to replace scripts that networkd-dispatcher believes to be owned by root to ones that are not."

Microsoft said it also found minor info-leaking bugs in [10]Blueman and [11]PackageKit on Linux.

[12]

According to Casey Bisson, head of product and developer relations at code security vendor BluBracket, these privilege-escalation holes could be useful for miscreants seeking to gain a stronger foothold in a Linux-dependent organization so that espionage or extortionware activities can be carried out.

"This is an interesting set of vulnerabilities affecting Linux desktop users," Bisson told The Register . "The risk footprint could be broad. Linux desktops aren't just for hobbyists. Tens of thousands of Google employees use a derivative of Debian as their desktop OS, and there are a number of other notable corporate, government and research facilities that have large Linux desktop deployments."

[13]AWS's Log4j patches blew holes in its own security

[14]Attackers exploit Spring4Shell flaw to let loose the Mirai botnet

[15]FBI: BlackCat ransomware scratched 60-plus orgs

[16]Microsoft ups bug bounties 30% for cloud lines, pays more for 'scenario-based' exploits

Open-source software continues to be a target of spies and crooks looking to exploit vulnerabilities. The [17]high-profile flaw found in the Log4j library late last year continues to be abused, and more recently fiends have looked to leverage the [18]Spring4Shell vulnerability in the Spring Framework.

Bud Broomhead, CEO of cybersecurity firm Viakoo, told The Register bugs like Nimbuspwn require action not just by users to fetch and install patches, but also distribution managers to spot fixes and push out updates in the first place. "By their nature they are harder to remediate and often have an extended vulnerability period because traditional solutions for detection and remediation may not apply, and because there are multiple Linux distributions – over 600 – there may equally be many patches needing to be applied," Broomhead said.

Bar Or wrote that networkd-dispatcher's maintainer Clayton Craft was notified of the holes and fixes were released; these should be filtering their way down to endpoints as they update their packages.

"Defending against the evolving threat landscape requires the ability to protect and secure users' computing experiences, be it a Windows or non-Windows device," Bar Or opined. "This case displayed how the ability to coordinate such research via expert, cross-industry collaboration is vital to effectively mitigate issues, regardless of the vulnerable device or platform in use." ®

Get our [19]Tech Resources



[1] https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YmoRas1@c6X14bEYfCxoAwAAAAQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://gitlab.com/craftyguy/networkd-dispatcher/-/tags/2.2

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YmoRas1@c6X14bEYfCxoAwAAAAQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YmoRas1@c6X14bEYfCxoAwAAAAQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29799

[7] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29800

[8] https://gitlab.com/craftyguy/networkd-dispatcher

[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YmoRas1@c6X14bEYfCxoAwAAAAQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[10] https://github.com/blueman-project/blueman/security/advisories/GHSA-3r9p-m5c8-8mw8

[11] https://access.redhat.com/security/cve/cve-2022-0987

[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YmoRas1@c6X14bEYfCxoAwAAAAQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[13] https://www.theregister.com/2022/04/20/aws_log4j_patches/

[14] https://www.theregister.com/2022/04/11/spring4shell-flaw-exploited-mirai-botnet/

[15] https://www.theregister.com/2022/04/25/in_brief_security/

[16] https://www.theregister.com/2022/04/18/in-brief-security/

[17] https://www.theregister.com/2022/04/20/aws_log4j_patches/

[18] https://www.theregister.com/2022/04/11/spring4shell-flaw-exploited-mirai-botnet/

[19] https://whitepapers.theregister.com/