Researchers at the Qualys’ Threat Research Unit demonstrated how to chain a new Linux vulnerability, tracked as CVE-2022-3328, with two other flaws to gain full root privileges on an affected system.
The vulnerability resides in the snap-confine function on Linux operating systems, a SUID-root program installed by default on Ubuntu.
The snap-confine is used internally by snapd to construct the execution environment for snap applications, an internal tool for confining snappy applications.
The CVE-2022-3328 is a Snapd race condition issue that can lead to local privilege escalation and arbitrary code execution.
“In February 2022, Qualys Threat Research Unit (TRU) published CVE-2021-44731 in our “Lemmings” advisory. The vulnerability (CVE-2022-3328) was introduced in February 2022 by the patch for CVE-2021-44731).” reads the post published by Qualys.
“The Qualys Threat Research Unit (TRU) exploited this bug in Ubuntu Server by combining it with two vulnerabilities in multipathd called Leeloo Multipath (an authorization bypass and a symlink attack, CVE-2022-41974 and CVE-2022-41973), to obtain full root privileges.”
The experts chained the CVE-2022-3328 flaw with two recently discovered flaws in Multipathd, which is a daemon in charge of checking for failed paths.
Multipathd runs as root in the default installation of several distributions, including Ubuntu.
The two vulnerabilities in the Multipathd are:
“Successful exploitation of the three vulnerabilities lets any unprivileged user gain root privileges on the vulnerable device. Qualys security researchers have verified the vulnerability, developed an exploit and obtained full root privileges on default installations of Ubuntu.” Qualys added.
The FAQ section included in the advisory confirms that the vulnerability is not remotely exploitable.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Linux)