Bug 2079999 (CVE-2022-29799) - CVE-2022-29799 networkd-dispatcher: Directory traversal
Summary: CVE-2022-29799 networkd-dispatcher: Directory traversal
Keywords:
Status: NEW
Alias: CVE-2022-29799
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2080002
TreeView+ depends on / blocked
 
Reported: 2022-04-28 17:16 UTC by Pedro Sampaio
Modified: 2023-08-01 12:39 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in networkd-dispatcher. This flaw exists because no functions are sanitized by the OperationalState or the AdministrativeState of networkd-dispatcher and lead to the directory traversal escaping from the “/etc/networkd-dispatcher” base directory.
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description Pedro Sampaio 2022-04-28 17:16:00 UTC
Microsoft has discovered several vulnerabilities, collectively referred to as Nimbuspwn, that could allow an attacker to elevate privileges to root on many Linux desktop endpoints. The vulnerabilities can be chained together to gain root privileges on Linux systems, allowing attackers to deploy payloads, like a root backdoor, and perform other malicious actions via arbitrary root code execution. Moreover, the Nimbuspwn vulnerabilities could potentially be leveraged as a vector for root access by more sophisticated threats, such as malware or ransomware, to achieve greater impact on vulnerable devices.

The vulnerabilities were found in the systemd unit networkd-dispatcher:

- CVE-2022-29799: directory traversal
- CVE-2022-29800: time-of-check-time-of-use (TOCTOU) race condition
- symlink race condition

Details:

[0] https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/


Note You need to log in before you can comment on or make changes to this bug.