7 ms·

A Crack in the Linux Firewall

264 points by emilburzo 4y ago

nuker 4y ago
> This vulnerability could be exploited to get a privilege escalation on Ubuntu 22.04. Nothing else is vulnerable?
- Zenst 4y ago
  As this was a linux kernal subsystem "netfilter subsystem of the Linux kernel" then I would presume not, and any kernel with the impacted subsystem present and equally exposed would be equally at risk. A bit like finding a flaw in a steering wheel used in a particular model of car when other car makes use that same steering wheel, yet were not tested in the findings. At least that is my interpretation of all this.
  - megous 4y ago
    The commit references this in the "Fixes" tag: https://github.com/torvalds/linux/commit/7d7402642eaf385aef0772eff5a35e34fc4995d7 https://github.com/torvalds/linux/commit/7d7402642eaf385aef0... That's a commit from 2015
  - zinekeller 4y ago
    > A bit like finding a flaw in a steering wheel used in a particular model of car when other car makes use that same steering wheel, yet were not tested in the findings. I kinda hoped you've reference airbags instead (https://en.wikipedia.org/wiki/Takata_Corporation#Defective_airbag_recalls_.282013.E2.80.93present.29 https://en.wikipedia.org/wiki/Takata_Corporation#Defective_a...)
- execveat 4y ago
  RHEL 9 (and likely many other distros with same kernel version) is vulnerable as well: https://access.redhat.com/security/cve/cve-2022-34918#cve-faq https://access.redhat.com/security/cve/cve-2022-34918#cve-fa...
- samus 4y ago
  This is stated to make independent verification of the exploit easier. It might or might not work on other systems, but security researchers and maintainers should waste as little time as possible to reproduce it!
oaiey 4y ago
To my very humble reading you need local system (non-root) access first. So no exploitation over the networking interface themselves. Disclaimer: Not a hacker, not an Linux pro.
- _8j50 4y ago
  That's my understanding as well.
- 752963e64 4y ago
- hutrdvnj 4y ago
  Yes, I think it's more of a toolkit hack. Given you have many of such hacks, find a way to combine them to make actual use of it.
- iso1631 4y ago
  Most exploited vulnerabilites are a combination - you get a local exploit in wordpress which allows you to run a bash script as the webserver user, but gives you limited control over the machine itself You then exploit a local privilige escalation vulnerability which gives you full access to the machine, allowing you to install backdoors etc for future access
- ncmncm 4y ago
  This used to be half of the two-step about every security hole: (1) this hole can only get you root running as an already authenticated user, or (2) this hole only gets an attacker restricted user-level permissions. Thankfully we don't see this so much lately. This post illustrates the large amount of extra work still needed to counter the depressingly common "this only corrupts unused memory, so it can't be exploited".
- antihero 4y ago
  But if you can exploit a script or processes that is network accessible to exec your own code, then you get "local system" access, no?
aorth 4y ago
Wow! If I understand correctly this is a local privilege escalation (the blog post doesn't mention "local" or "remote"). But it seems it could also be used to get remote code execution? I wish there was a list of distribution kernels that are vulnerable and which have already patched this. Would be valuable to add to the blog post and the GitHub repo. https://github.com/randorisec/CVE-2022-34918-LPE-PoC https://github.com/randorisec/CVE-2022-34918-LPE-PoC
- _8j50 4y ago
  Yup, it is essentially exploiting the subsystem firewalls like iptables use under the hood, you can't mess with that remotely.
  - _wldu 4y ago
    That looks like nftables (the successor to iptables).
  - Mtinie 4y ago
    "...you can't mess with that remotely." I don't know enough about the subject to agree or disagree with this statement but you've got me curious. Is that a: A. "It's fundamentally impossible to make this change because operating systems cannot be modified in this way by a remote system" (i.e. making a change at this level of the architecture would result in the remote connection being dropped and all of the attackers work becomes moot.) B. "The code has been reviewed and hardened sufficiently that experts are universally assured that attempting this type of remote change will fail." ...or am I looking at this the wrong way and it's secure for a completely different reason? I've always been taught to be skeptical of any statement of perceived certainty when it involves computer security so I appreciate additional details so I can expand my knowledge. Thank you in advance!
    - execveat 4y ago
      API used in the PoC is not used during parsing of the traffic. In order to trigger the bug remotely you'd either need to chain it with another exploit or have a way of running arbitrary commands as a local user (e.g. by exploiting webapp).
_8j50 4y ago
My understanding is you need CAP_NET_ADMIN first right? Which is enabled by default for an interactive user on Ubuntu. But is it enabled for say www-data? If I pop a shell on wordpress for example, I would need to compromise another account with that capability right? Or is CAP_NET_ADMIN enabled for non-interactive system users or not required for this LPE?
- tommiegannert 4y ago
  Looking at the exploit code [1], sadly, you don't... They're using the fact that you can become "root" in a new namespace. So you need cgroups. After that, you're free to change NFTables in that namespace. I was just playing around with this: $ unshare -r --net --user capsh --print and comparing it to $ sudo capsh --print Both give you all caps. Exploiting a parser bug in NFTables doesn't require access to the main namespace; just something to get past the initial cap checks. (IIUC.) Edit: the commands above were run on Ubuntu 21.10. [1] https://github.com/randorisec/CVE-2022-34918-LPE-PoC/blob/main/src/util.c#L31 https://github.com/randorisec/CVE-2022-34918-LPE-PoC/blob/ma...
  - _8j50 4y ago
    I didn't even think if namespaces! Thanks for clarifying.
    - raesene9 4y ago
      It's worth noting that it is possible to disable unprivileged user namespaces, but the default on several modern linux distros is to have it enabled.
    - tommiegannert 4y ago
      It's indeed a pretty cool combination of ideas to get to the final exploit. I just had a discussion about whether programming is mostly creative or analytical. Seeing this post, the answer (next time) will be "yes."
      - 4y ago
jve 4y ago
Speaking about iptables - is there anything in the wild that allows users make request to web port and I can approve/deny particular requests? For example, 443/TCP is blocked from world. However if someone opens web page, it returns <html><body>Access request from IP xxx.xxx.xxx.xxx has been submitted</body></html> (or maybe a form where you put port number you'd like to access) and from server-side I can somehow see those requests, useragents and accept/deny and just ignore bots. Use-case: Some photoalbum is locked down, accessed by particular IPs/countries/vpn (to reduce or prevent bruteforcing, automated hacking and such) - however I'd like to give access to someone (who doesn't know his IP) by just giving him a domain name. https://photos.example.com https://photos.example.com - yeah, he sees that unfriendly page. After a while I call him and say - try again and poof, next time he opens the page, he penetrates the firewall and gets pictures. The thing is: - VPN is too much of an ask to a person I want to send a link to some data - Country block is very rough filter, just helps to reduce some log traffic from uninteresting countries with loads of bots. - Asking person his IP is very manual: "please open/google up such phrase, send me that address and I'll look up my notes to copy/paste that iptables command and I'll modify it slightly (or add some config entry to .htaccess) to put your IP in and then you'll have access until you reconnect to your mobile network or your ISP gives you new DHCP address and then we'll repeat" "Knockwall" doesn't return much results, eh.
- neapolisbeach 4y ago
  Port knocking maybe? https://en.m.wikipedia.org/wiki/Port_knocking https://en.m.wikipedia.org/wiki/Port_knocking
- iso1631 4y ago
  You'd be running a webserver on your firewall. If you want that, just run the webserver and base the response on IP address (have your 401 forbidden page say "forbidden", and allow from 1.2.3.4). Or do a username/password, or do something like openauth to integrate with an identity provider
  - jve 4y ago
    Managing IPs manually is same amount of work as managing iptables - see updated question. Yeah, integrating identity providers could work, knowing recipient email addresses and that they use particular services. However that has some complexity/libraries and as with that - vulnerabilities all over again. I just don't want to think/expose attack surface and give possibilities for automated attacks to leak personal data. Or lets say it like that - I trust iptables more than myself integrating identity provider or depending on some library. Actually this is what onedrive/photo galleries etc. does when you share files/folders - generates some magic link that penetrates auth. However it's the same story - I trust complex system (that may have well known vulnerabilities and I was on a vacation) less than iptables.
linsomniac 4y ago
TL;DR: Local privileges escalation in iptables on Ubuntu 22.04 and RHEL 9. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34918 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3491... https://access.redhat.com/security/cve/cve-2022-34918 https://access.redhat.com/security/cve/cve-2022-34918
sharmin123 4y ago
claudiojulio 4y ago
Will the fix only be available in kernel 5.19?
- fulafel 4y ago
  These generally get backported when needed, check your distribution's kernel updates and the stable / longterm kernel.org trains. Here's eg the fix in the 5.18.12 tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.18.12&id=6b7488071ea8ed6265a39afebd5a5920f6975d02 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux...
  - claudiojulio 4y ago
    Thanks!
iam-TJ 4y ago
The proof of concept (PoC) itself relies on /tmp/ having mount 'exec' permissions. On systems with a separate /tmp/ and mounted with 'noexec' this would fail. This latter is one of a series of hardening steps that are useful in making executing untrusted code more difficult (but not impossible). Fix is introduced in commit 7e6bc1f6cabcd30aba0b11219d8e01b952eacbb6. On the wider point of kernel corruption it isn't absolutely clear if the PoC relies on specific attributes of the target kernel builds or a suitable .config, and if so which, or very specific kernel versions between v4.1-rc1 and v5.19-rc7. Article talks specifically about "Ubuntu 22.04" and shows kernel 5.15.0-27-generic in the poc.gif but the github README.md says 5.15.0-39-generic. No mention if this affects the -lowlatency kernels. Recent Linux stable tree kernels carry the patch (e.g. v5.18.12 commit 6b7488071ea8ed6265a39afebd5a5920f6975d02). The exploit fails (here) on stable tree v5.18.9 in an interesting way! $ ./poc [+] Second process currently waiting [+] Get CAP_NET_ADMIN capability [+] Netlink socket created [+] Netlink socket bound [+] Table table created [+] Set for the leak created [+] Set for write primitive created [*] Leak in process[-] add_key: Disk quota exceeded This on an ext4 file-system with no quotas enabled and 9GiB free space. The message via perror() is of course wrong; in fact during the call via SYSCALL_DEFINES(add_key, ...) in security/keys/keyctl.c a return value of 122 (EDQUOT) is returned. There are 3 call sites in that function that call PTR_ERR() - a function that determines if a pointer value is a valid 'errno' value - so one of strndup_user(), lookup_user_key(), or key_create_or_update() failed.
- franzIncarnate 4y ago
  > [*] Leak in process[-] add_key: Disk quota exceeded I'm taking an educated guess, try: sysctl user.max_user_namespaces I'm guessing it's "0", which means user namespaces are disabled on your system. This would be an effective mitigation against most of these namespace exploits. If you type "unshare -rT" you'll likely get a "No space left on device" or something instead of a faux-root namespace shell.
  - iam-TJ 4y ago
    No; I use namespaces extensively. user.max_user_namespaces = 127864
anewpersonality 4y ago
A rustOS can't come soon enough!
deleted 4y ago
[deleted]

264 points by emilburzo 4y ago

nuker 4y ago

> This vulnerability could be exploited to get a privilege escalation on Ubuntu 22.04. Nothing else is vulnerable?

Zenst 4y ago
As this was a linux kernal subsystem "netfilter subsystem of the Linux kernel" then I would presume not, and any kernel with the impacted subsystem present and equally exposed would be equally at risk. A bit like finding a flaw in a steering wheel used in a particular model of car when other car makes use that same steering wheel, yet were not tested in the findings. At least that is my interpretation of all this.
- megous 4y ago
  The commit references this in the "Fixes" tag: https://github.com/torvalds/linux/commit/7d7402642eaf385aef0772eff5a35e34fc4995d7 https://github.com/torvalds/linux/commit/7d7402642eaf385aef0... That's a commit from 2015
- zinekeller 4y ago
  > A bit like finding a flaw in a steering wheel used in a particular model of car when other car makes use that same steering wheel, yet were not tested in the findings. I kinda hoped you've reference airbags instead (https://en.wikipedia.org/wiki/Takata_Corporation#Defective_airbag_recalls_.282013.E2.80.93present.29 https://en.wikipedia.org/wiki/Takata_Corporation#Defective_a...)
execveat 4y ago
RHEL 9 (and likely many other distros with same kernel version) is vulnerable as well: https://access.redhat.com/security/cve/cve-2022-34918#cve-faq https://access.redhat.com/security/cve/cve-2022-34918#cve-fa...
samus 4y ago
This is stated to make independent verification of the exploit easier. It might or might not work on other systems, but security researchers and maintainers should waste as little time as possible to reproduce it!

oaiey 4y ago

To my very humble reading you need local system (non-root) access first. So no exploitation over the networking interface themselves. Disclaimer: Not a hacker, not an Linux pro.

_8j50 4y ago
That's my understanding as well.
752963e64 4y ago
hutrdvnj 4y ago
Yes, I think it's more of a toolkit hack. Given you have many of such hacks, find a way to combine them to make actual use of it.
iso1631 4y ago
Most exploited vulnerabilites are a combination - you get a local exploit in wordpress which allows you to run a bash script as the webserver user, but gives you limited control over the machine itself You then exploit a local privilige escalation vulnerability which gives you full access to the machine, allowing you to install backdoors etc for future access
ncmncm 4y ago
This used to be half of the two-step about every security hole: (1) this hole can only get you root running as an already authenticated user, or (2) this hole only gets an attacker restricted user-level permissions. Thankfully we don't see this so much lately. This post illustrates the large amount of extra work still needed to counter the depressingly common "this only corrupts unused memory, so it can't be exploited".
antihero 4y ago
But if you can exploit a script or processes that is network accessible to exec your own code, then you get "local system" access, no?

aorth 4y ago

Wow! If I understand correctly this is a local privilege escalation (the blog post doesn't mention "local" or "remote"). But it seems it could also be used to get remote code execution? I wish there was a list of distribution kernels that are vulnerable and which have already patched this. Would be valuable to add to the blog post and the GitHub repo. https://github.com/randorisec/CVE-2022-34918-LPE-PoC https://github.com/randorisec/CVE-2022-34918-LPE-PoC

_8j50 4y ago
Yup, it is essentially exploiting the subsystem firewalls like iptables use under the hood, you can't mess with that remotely.
- _wldu 4y ago
  That looks like nftables (the successor to iptables).
- Mtinie 4y ago
  "...you can't mess with that remotely." I don't know enough about the subject to agree or disagree with this statement but you've got me curious. Is that a: A. "It's fundamentally impossible to make this change because operating systems cannot be modified in this way by a remote system" (i.e. making a change at this level of the architecture would result in the remote connection being dropped and all of the attackers work becomes moot.) B. "The code has been reviewed and hardened sufficiently that experts are universally assured that attempting this type of remote change will fail." ...or am I looking at this the wrong way and it's secure for a completely different reason? I've always been taught to be skeptical of any statement of perceived certainty when it involves computer security so I appreciate additional details so I can expand my knowledge. Thank you in advance!
  - execveat 4y ago
    API used in the PoC is not used during parsing of the traffic. In order to trigger the bug remotely you'd either need to chain it with another exploit or have a way of running arbitrary commands as a local user (e.g. by exploiting webapp).

_8j50 4y ago

My understanding is you need CAP_NET_ADMIN first right? Which is enabled by default for an interactive user on Ubuntu. But is it enabled for say www-data? If I pop a shell on wordpress for example, I would need to compromise another account with that capability right? Or is CAP_NET_ADMIN enabled for non-interactive system users or not required for this LPE?

tommiegannert 4y ago
Looking at the exploit code [1], sadly, you don't... They're using the fact that you can become "root" in a new namespace. So you need cgroups. After that, you're free to change NFTables in that namespace. I was just playing around with this: $ unshare -r --net --user capsh --print and comparing it to $ sudo capsh --print Both give you all caps. Exploiting a parser bug in NFTables doesn't require access to the main namespace; just something to get past the initial cap checks. (IIUC.) Edit: the commands above were run on Ubuntu 21.10. [1] https://github.com/randorisec/CVE-2022-34918-LPE-PoC/blob/main/src/util.c#L31 https://github.com/randorisec/CVE-2022-34918-LPE-PoC/blob/ma...
- _8j50 4y ago
  I didn't even think if namespaces! Thanks for clarifying.
  - raesene9 4y ago
    It's worth noting that it is possible to disable unprivileged user namespaces, but the default on several modern linux distros is to have it enabled.
  - tommiegannert 4y ago
    It's indeed a pretty cool combination of ideas to get to the final exploit. I just had a discussion about whether programming is mostly creative or analytical. Seeing this post, the answer (next time) will be "yes."
    - 4y ago

jve 4y ago

Speaking about iptables - is there anything in the wild that allows users make request to web port and I can approve/deny particular requests? For example, 443/TCP is blocked from world. However if someone opens web page, it returns <html><body>Access request from IP xxx.xxx.xxx.xxx has been submitted</body></html> (or maybe a form where you put port number you'd like to access) and from server-side I can somehow see those requests, useragents and accept/deny and just ignore bots. Use-case: Some photoalbum is locked down, accessed by particular IPs/countries/vpn (to reduce or prevent bruteforcing, automated hacking and such) - however I'd like to give access to someone (who doesn't know his IP) by just giving him a domain name. https://photos.example.com https://photos.example.com - yeah, he sees that unfriendly page. After a while I call him and say - try again and poof, next time he opens the page, he penetrates the firewall and gets pictures. The thing is: - VPN is too much of an ask to a person I want to send a link to some data - Country block is very rough filter, just helps to reduce some log traffic from uninteresting countries with loads of bots. - Asking person his IP is very manual: "please open/google up such phrase, send me that address and I'll look up my notes to copy/paste that iptables command and I'll modify it slightly (or add some config entry to .htaccess) to put your IP in and then you'll have access until you reconnect to your mobile network or your ISP gives you new DHCP address and then we'll repeat" "Knockwall" doesn't return much results, eh.

neapolisbeach 4y ago
Port knocking maybe? https://en.m.wikipedia.org/wiki/Port_knocking https://en.m.wikipedia.org/wiki/Port_knocking
iso1631 4y ago
You'd be running a webserver on your firewall. If you want that, just run the webserver and base the response on IP address (have your 401 forbidden page say "forbidden", and allow from 1.2.3.4). Or do a username/password, or do something like openauth to integrate with an identity provider
- jve 4y ago
  Managing IPs manually is same amount of work as managing iptables - see updated question. Yeah, integrating identity providers could work, knowing recipient email addresses and that they use particular services. However that has some complexity/libraries and as with that - vulnerabilities all over again. I just don't want to think/expose attack surface and give possibilities for automated attacks to leak personal data. Or lets say it like that - I trust iptables more than myself integrating identity provider or depending on some library. Actually this is what onedrive/photo galleries etc. does when you share files/folders - generates some magic link that penetrates auth. However it's the same story - I trust complex system (that may have well known vulnerabilities and I was on a vacation) less than iptables.

linsomniac 4y ago

TL;DR: Local privileges escalation in iptables on Ubuntu 22.04 and RHEL 9. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34918 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3491... https://access.redhat.com/security/cve/cve-2022-34918 https://access.redhat.com/security/cve/cve-2022-34918

sharmin123 4y ago

claudiojulio 4y ago

Will the fix only be available in kernel 5.19?

fulafel 4y ago
These generally get backported when needed, check your distribution's kernel updates and the stable / longterm kernel.org trains. Here's eg the fix in the 5.18.12 tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.18.12&id=6b7488071ea8ed6265a39afebd5a5920f6975d02 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux...
- claudiojulio 4y ago
  Thanks!

iam-TJ 4y ago

The proof of concept (PoC) itself relies on /tmp/ having mount 'exec' permissions. On systems with a separate /tmp/ and mounted with 'noexec' this would fail. This latter is one of a series of hardening steps that are useful in making executing untrusted code more difficult (but not impossible). Fix is introduced in commit 7e6bc1f6cabcd30aba0b11219d8e01b952eacbb6. On the wider point of kernel corruption it isn't absolutely clear if the PoC relies on specific attributes of the target kernel builds or a suitable .config, and if so which, or very specific kernel versions between v4.1-rc1 and v5.19-rc7. Article talks specifically about "Ubuntu 22.04" and shows kernel 5.15.0-27-generic in the poc.gif but the github README.md says 5.15.0-39-generic. No mention if this affects the -lowlatency kernels. Recent Linux stable tree kernels carry the patch (e.g. v5.18.12 commit 6b7488071ea8ed6265a39afebd5a5920f6975d02). The exploit fails (here) on stable tree v5.18.9 in an interesting way! $ ./poc [+] Second process currently waiting [+] Get CAP_NET_ADMIN capability [+] Netlink socket created [+] Netlink socket bound [+] Table table created [+] Set for the leak created [+] Set for write primitive created [*] Leak in process[-] add_key: Disk quota exceeded This on an ext4 file-system with no quotas enabled and 9GiB free space. The message via perror() is of course wrong; in fact during the call via SYSCALL_DEFINES(add_key, ...) in security/keys/keyctl.c a return value of 122 (EDQUOT) is returned. There are 3 call sites in that function that call PTR_ERR() - a function that determines if a pointer value is a valid 'errno' value - so one of strndup_user(), lookup_user_key(), or key_create_or_update() failed.

franzIncarnate 4y ago
> [*] Leak in process[-] add_key: Disk quota exceeded I'm taking an educated guess, try: sysctl user.max_user_namespaces I'm guessing it's "0", which means user namespaces are disabled on your system. This would be an effective mitigation against most of these namespace exploits. If you type "unshare -rT" you'll likely get a "No space left on device" or something instead of a faux-root namespace shell.
- iam-TJ 4y ago
  No; I use namespaces extensively. user.max_user_namespaces = 127864

anewpersonality 4y ago

A rustOS can't come soon enough!

deleted 4y ago

[deleted]