Microsoft has discovered vulnerabilities in system components commonly used on Linux desktops that could allow an attacker to elevate privileges to root and install malware.
Gaining root privileges on a compromised Linux desktop would allow the attackers to perform nefarious tasks, such as installing a root backdoor, or to undertake other malicious actions via arbitrary root code execution via the flaws Microsoft is calling Nimbuspwn.
“Moreover, the Nimbuspwn vulnerabilities could potentially be leveraged as a vector for root access by more sophisticated threats, such as malware or ransomware, to achieve greater impact on vulnerable devices,” Microsoft said.
The two bugs, tracked as CVE-2022-29799 and CVE-2022-29800, were found in networkd-dispatcher, a dispatcher service for systemd-networkd network connection status changes. Microsoft said it discovered the vulnerabilities by listening to messages on the System Bus while performing code reviews and dynamic analysis on services that run as root – and spotting an odd pattern in networkd-dispatcher.
SEE: These are the problems that cause headaches for bug bounty hunters
D-Bus is developed by the freedesktop.org project, while networkd-dispatcher is maintained by Clayton Craft, who has updated his component to address the flaws Microsoft found.
D-Bus components are a nice target for attackers. First, many D-Bus components ship by default on popular desktop Linux distributions, such as Linux Mint. Second, the components run at different privileges and respond to messages. For example, a video-conferencing app sending a D-Bus signal indicating that a call has started could tell any apps listening to respond by muting their audio.
But D-Bus leads to an even better target: System Bus, which led Jonathan Bar Or, of the Microsoft 365 Defender Research Team, to the discovery of issues in networkd-dispatcher.
“D-Bus exposes a global System Bus and a per-session Session Bus. From an attacker’s perspective, the System Bus is more attractive since it will commonly have services that run as root listening to it,” explains Or in a blogpost.
The security issues in networkd-dispatcher included a directory traversal, symlink race, and time-of-check-time-of-use race condition issues, which could be combined by an attacker to elevate privileges to root and from there install malware.
Given Craft has updated networkd-dispatcher and exploit examples are public, Linux desktop users should update the affected component as soon as possible.
“We wish to thank Clayton for his professionalism and collaboration in resolving those issues. Users of networkd-dispatcher are encouraged to update their instances,” Microsoft said.
