Researcher bags two-for-one deal on Linux bugs while probing GNOME component
(2023/10/10)
- Reference: 1696953670
- News link: https://www.theregister.co.uk/2023/10/10/linux_gnome_libcue_exploit/
- Source link:
Researchers discovered a high-severity remote code execution (RCE) vulnerability in an inherent component of GNOME-based Linux distros, potentially impacting a huge number of users.
Tracked as CVE-2023-43641, exploiting the vulnerability in the relatively small libcue library takes advantage of the tracker-miners application to facilitate a one-click RCE attack.
The issue is thought to affect all GNOME-based distros, including RHEL, SUSE, and Debian, but has only been proven to work on the latest versions of Ubuntu and Fedora so far.
[1]
A user just has to download a file and have it stored in a commonly scanned directory, such as the downloads, music, or videos folders, and the attacker can achieve RCE on their machine.
[2]
[3]
The libcue library is a relatively small one that's used to parse cue sheets – .cue files – which store the metadata that defines the layout of music on a CD. Given that it's often used alongside the FLAC audio format, open source audio players like Audacious are dependent on the library.
More importantly, another application that uses libcue is tracker-miners, which is included in [4]GNOME -based Linux distros and is responsible for indexing files in the user's directory so they appear in search results.
Image courtesy of GitHub
The tracker-miners application initializes automatically when a file is either added or modified in a subdirectory of the home directory. This means the exploit can be executed as soon as the user downloads a maliciously crafted .cue file, since tracker-miners uses libcue to pass the cue sheets file.
"To make a long story short, that means that inadvertently clicking a malicious link is all it takes for an attacker to exploit CVE-2023-43641 and get code execution on your computer," [5]said Kevin Backhouse, security researcher at GitHub Security Lab team.
[6]
Other files are also supported by tracker-miners – it has scanners for HTML, JPEG, and PDF files too – but the researcher's proof of concept (PoC) code was limited to using cue sheet files.
Exploiting libcue
Backhouse has only created working exploits for the most recent versions of Ubuntu and Fedora, 23.04 and 38 respectively, but believes any GNOME-based distro is "potentially exploitable".
The full PoCs have not been published yet to offer users time to install the patch. Backhouse said the exploits already developed work "very reliably."
The bug itself is categorized as a memory corruption flaw and has been given a provisional severity rating of 8.8 by GitHub. The CVSS score is still being determined.
An issue with the way in which the INDEX syntax of a cue sheet is handled allows a negative index to be constructed because the atoi method doesn't check for integer overflow.
[7]
The scanner's track_set_index function doesn't properly check if the index is a negative integer, and if it is negative, then an [8]out of bounds write exploit becomes possible. voidtrack_set_index
{
if (i MAXINDEX) {
fprintf(stderr, "too many indexes\n");
return;
}
track-index[i] = ind;
}
Due to the consistency of each distro's heap layout, an attacker could feasibly compile a zip archive containing individual files to exploit the same vulnerability in as many distros as they like to maximize the potential for success.
If these files were all unarchived, only the one that matches the user's distro would be needed to pull off the attack.
[9]Cisco warns of critical flaw in Emergency Responder code
[10]IT networks under attack via critical Confluence zero-day. Patch now
[11]Trio of TorchServe flaws means PyTorch users need an urgent upgrade
[12]Arm patches GPU driver bug exploited by spyware to snoop on targets
The tracker-extract process of tracker-miners makes the memory layout of each distro easier to predict because a new process is started every time tracker-miners starts, rather than contending with a process that's been running for hours.
A fresh thread is also started by tracker-extract each time. Backhouse said the heap layout in the thread's malloc arena "is very consistent" but varies between [13]distros , meaning the multi-file zip archive would be the most effective approach for attackers.
The bonus bug
Backhouse encountered an issue when developing the PoC exploit for the vulnerability because the tracker-extract component of tracker-miners has a seccomp sandbox that prevents this kind of exploit from running.
After not realizing that he needed a sandbox escape, Backhouse tried a different method to exploit it, focusing on avoiding the function that previously threw the error, and inadvertently discovered a sandbox escape that was previously unknown to GNOME's developers.
The sandbox escape has already been fixed, and Backhouse plans to publish the original PoC with one line changed to get it to work without the sandbox escape once enough time has passed to allow users to fully [14]patch their systems. ®
Get our [15]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZSXJgwiCY3jXn@ldYbMlkQAAAME&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZSXJgwiCY3jXn@ldYbMlkQAAAME&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZSXJgwiCY3jXn@ldYbMlkQAAAME&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2023/09/08/gnome_45_esm_extensions/
[5] https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZSXJgwiCY3jXn@ldYbMlkQAAAME&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZSXJgwiCY3jXn@ldYbMlkQAAAME&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2023/06/29/cwe_top_25_2023/
[9] https://www.theregister.com/2023/10/05/cisco_icritical_emergency/
[10] https://www.theregister.com/2023/10/04/critical_confluence_privilege_escalation_bug/
[11] https://www.theregister.com/2023/10/04/shelltorch_vulnerabilities/
[12] https://www.theregister.com/2023/10/03/arm_mali_gpu_attack/
[13] https://www.theregister.com/2023/09/07/linux_distro_roundup_fall_23/
[14] https://www.theregister.com/security/patches/
[15] https://whitepapers.theregister.com/
Tracked as CVE-2023-43641, exploiting the vulnerability in the relatively small libcue library takes advantage of the tracker-miners application to facilitate a one-click RCE attack.
The issue is thought to affect all GNOME-based distros, including RHEL, SUSE, and Debian, but has only been proven to work on the latest versions of Ubuntu and Fedora so far.
[1]
A user just has to download a file and have it stored in a commonly scanned directory, such as the downloads, music, or videos folders, and the attacker can achieve RCE on their machine.
[2]
[3]
The libcue library is a relatively small one that's used to parse cue sheets – .cue files – which store the metadata that defines the layout of music on a CD. Given that it's often used alongside the FLAC audio format, open source audio players like Audacious are dependent on the library.
More importantly, another application that uses libcue is tracker-miners, which is included in [4]GNOME -based Linux distros and is responsible for indexing files in the user's directory so they appear in search results.
Image courtesy of GitHub
The tracker-miners application initializes automatically when a file is either added or modified in a subdirectory of the home directory. This means the exploit can be executed as soon as the user downloads a maliciously crafted .cue file, since tracker-miners uses libcue to pass the cue sheets file.
"To make a long story short, that means that inadvertently clicking a malicious link is all it takes for an attacker to exploit CVE-2023-43641 and get code execution on your computer," [5]said Kevin Backhouse, security researcher at GitHub Security Lab team.
[6]
Other files are also supported by tracker-miners – it has scanners for HTML, JPEG, and PDF files too – but the researcher's proof of concept (PoC) code was limited to using cue sheet files.
Exploiting libcue
Backhouse has only created working exploits for the most recent versions of Ubuntu and Fedora, 23.04 and 38 respectively, but believes any GNOME-based distro is "potentially exploitable".
The full PoCs have not been published yet to offer users time to install the patch. Backhouse said the exploits already developed work "very reliably."
The bug itself is categorized as a memory corruption flaw and has been given a provisional severity rating of 8.8 by GitHub. The CVSS score is still being determined.
An issue with the way in which the INDEX syntax of a cue sheet is handled allows a negative index to be constructed because the atoi method doesn't check for integer overflow.
[7]
The scanner's track_set_index function doesn't properly check if the index is a negative integer, and if it is negative, then an [8]out of bounds write exploit becomes possible. voidtrack_set_index
{
if (i MAXINDEX) {
fprintf(stderr, "too many indexes\n");
return;
}
track-index[i] = ind;
}
Due to the consistency of each distro's heap layout, an attacker could feasibly compile a zip archive containing individual files to exploit the same vulnerability in as many distros as they like to maximize the potential for success.
If these files were all unarchived, only the one that matches the user's distro would be needed to pull off the attack.
[9]Cisco warns of critical flaw in Emergency Responder code
[10]IT networks under attack via critical Confluence zero-day. Patch now
[11]Trio of TorchServe flaws means PyTorch users need an urgent upgrade
[12]Arm patches GPU driver bug exploited by spyware to snoop on targets
The tracker-extract process of tracker-miners makes the memory layout of each distro easier to predict because a new process is started every time tracker-miners starts, rather than contending with a process that's been running for hours.
A fresh thread is also started by tracker-extract each time. Backhouse said the heap layout in the thread's malloc arena "is very consistent" but varies between [13]distros , meaning the multi-file zip archive would be the most effective approach for attackers.
The bonus bug
Backhouse encountered an issue when developing the PoC exploit for the vulnerability because the tracker-extract component of tracker-miners has a seccomp sandbox that prevents this kind of exploit from running.
After not realizing that he needed a sandbox escape, Backhouse tried a different method to exploit it, focusing on avoiding the function that previously threw the error, and inadvertently discovered a sandbox escape that was previously unknown to GNOME's developers.
The sandbox escape has already been fixed, and Backhouse plans to publish the original PoC with one line changed to get it to work without the sandbox escape once enough time has passed to allow users to fully [14]patch their systems. ®
Get our [15]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZSXJgwiCY3jXn@ldYbMlkQAAAME&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZSXJgwiCY3jXn@ldYbMlkQAAAME&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZSXJgwiCY3jXn@ldYbMlkQAAAME&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2023/09/08/gnome_45_esm_extensions/
[5] https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZSXJgwiCY3jXn@ldYbMlkQAAAME&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZSXJgwiCY3jXn@ldYbMlkQAAAME&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2023/06/29/cwe_top_25_2023/
[9] https://www.theregister.com/2023/10/05/cisco_icritical_emergency/
[10] https://www.theregister.com/2023/10/04/critical_confluence_privilege_escalation_bug/
[11] https://www.theregister.com/2023/10/04/shelltorch_vulnerabilities/
[12] https://www.theregister.com/2023/10/03/arm_mali_gpu_attack/
[13] https://www.theregister.com/2023/09/07/linux_distro_roundup_fall_23/
[14] https://www.theregister.com/security/patches/
[15] https://whitepapers.theregister.com/
Paul Crawford
Originally we had 'locate' to find files, now we have something trying to be clever and showing how that is not clever at all.
Sadly this sort of "progress" seems to be an epidemic in the software world.
gosand
"Originally"? I still use locate. In fact, I overheard someone at work talking to someone else about options for running 'find', and I said "Don't forget about locate" and he didn't know what it was. He ran it and said "I'll have to remember that, you can teach an old dog new tricks". He's a few years younger than me, but higher up and quite technical.
Disabling file indexer is an important part of new system decrudification checklist
lvm
Utterly useless CPU hog.Only in my world it is called baloo :)
That does it!
MiguelC
I'm tired of this litany of Linux bugs, I'm switching to Windows!!!1!
Re: That does it!
Blazde
Mate libcue is a library hosted on GitHub
And who owns GitHub..?
Yes! The very same..
Join the dots. The truth can never stay hidden. This is clearly a false flag op designed to muddy the pristine reputation of Our Lord Linux. In reality just another Microsoft bug. Like always
libcu*.so
petef
libcurl and libcue. Watch out for vulnerabilities in CUPS and curses next.
why would you have anything installed with "tracker" in its name!
Some of us took one look at the package list and found something called "tracker" and immediately ran `yum remove \*tracker\*`