DirtySoc-Vulnerability does not sound like fun

Ubuntu and other Linux distributions are used worldwide. These offer many functions and attributes the other primary options don’t. These also happen to be open source. While beloved, these still may add aggravation and headaches when installing or attempting other tasks. While there has not been a multitude of attacks against this, as with the Windows monumental franchise, there was recently added one more-DirtySock.

DirtySock Vulnerability (CVE-2019-7304)

The researcher (Chris Moberly) published the proof-of-concept (PoC) code for this exploit. The research discovered the issue near the end of January 2019. As a responsible party, Moberly did work with Canonical to fix the issue.

Operates

Snapd are applications which “contain” the files, libraries, and programs required for an application to process and work. The vulnerability in the code does not allow the attacker to compromise the system. What it, however, does allow is the attacker greater access once the attacker finds and gains access to an unpatched system. This flaw is in the local privileges allows or this significant privilege escalation. In summary, this allows attackers to create root-level user accounts, when unauthorized to do so, which is a very bad option for the administrators. The vulnerability lies with the snapd daemon. The issue is a default with the recent Ubuntu version. The Snapd daemon manages the “snaps” beginning in 2014. This allows the user to download apps and install them in the .snap file format. The vulnerability allows access to a local REST API server. This allows the attackers to overwrite the UID variable and access any API function. This server interacts with the snap package during the installation process. The code allows the attacker to work-around the access control restrictions used by the API server. To authenticate this, the researcher provided two exploits as examples, which may be used for vulnerability.

Mediation

Ubuntu is open source, however, in certain instances, there is a license required. The licensing business, or parent company, is Canonical. They have issued a patch for the issue. Canonical continues to show their focus on updates to the OS. This was addressed in Snapd version 2.37.1. They also released security updates for Ubuntu Linux OS.

Resources

Abrams, L. (2019, February 13). Canonical snapd vulnerability gives root access in linux. Retrieved from https://bleepingcomputer.com/news/security/canonical-snapd-vulnerability-gives-root-access-in-linux

PenTest Tools. (2019, February 14). Snapd flaw lets attackers gain root access on linux systems. Retrieved from https://pentesttools.net/snapd-flaw-lets-attackers-gain-root-access-on-linux-systems/

Sowells, J. (2019, February 13). Attackers gain root access on linux system via dirty sock vulnerability. Retrieved from https://hackercombat.com/attackers-gain-root-access-on-linux-systems-via-dirty-sock-vulnerability/