Microsoft security researchers have detected two vulnerabilities that could allow threat actors to carry out a series of malicious activities with root privileges on Linux systems. The vulnerabilities collectively called “Nimbuspwn” can be used to gain root privileges on Linux systems and allow threat actors to deploy various malicious software such as backdoor and ransomware to the vulnerable system.
Nimbuspwn security vulnerabilities, tracked as CVE-2022-29799 and CVE-2022-29800, exist in networkd-dispatcher, a component that sends link state changes on Linux machines. The vulnerability tracked as code CVE-2022-29799 exists due to a Directory Traversal error in the _run_hooks_for_state function in the source code of networkd-dispatcher. Another security vulnerability with code CVE-2022-29800 is related to a time-of-check to time-of-use (TOCTOU) error in the _run_hooks_for_state function.
To not be the target of malware campaigns that can be carried out using these security vulnerabilities, users of networkd-dispatcher are advised to immediately update the vulnerable versions to the latest version that fixes the vulnerabilities.
Who found Nimbuspwn, and how?
Microsoft published its findings on 26 April 2022 in a blog post on Nimbuspwn. The research team, which included Jonathan Bar Or of the Microsoft 365 Defender Research Team, found the flaws while watching System Bus messages and analyzing services that run as root. They noticed unusual behavior in the networkd-dispatcher systemd unit.
Microsoft describes three flaws that can be chained: a directory traversal (CVE-2022-29799), a symlink race and a time-of-check to time-of-use race (CVE-2022-29800). Only the first and last have CVE ids.
How does an attack work?
In Microsoft’s description, an attacker runs a malicious D-Bus component and abuses the flaws to make the service run attacker-planted programs as root. The attacker has to claim a specific D-Bus bus name. That was possible in some setups, for example where systemd-networkd does not start by default, or where the systemd-network account runs code from world-writable locations. The researchers said three attempts were enough to win the race. Their demonstration created a setuid shell as a backdoor.
The public records add detail. The NVD entry for CVE-2022-29799 says the flaw comes from unsanitized OperationalState and AdministrativeState values, which let an attacker escape the /etc/networkd-dispatcher base directory. The NVD entry for CVE-2022-29800 says there is a gap between the time scripts are found and the time they run. An attacker can use that gap to swap in scripts that are not owned by root. Both entries were published on 21 September 2022. NVD gives CVE-2022-29799 a CVSS 3.1 base score of 5.5 and CVE-2022-29800 a score of 4.7, both in the medium range, and the attacker needs local access to the machine.
What is the fix?
Microsoft says the networkd-dispatcher maintainer, Clayton Craft, shipped fixes for both CVEs and urges users to update. Check your distribution’s security notice for the patched package version. Microsoft Defender for Endpoint detects the directory traversal behavior, and Microsoft’s threat and vulnerability management covers both CVEs. Beyond updating, review which accounts can run code on the host. Our glossary pages on patch management and vulnerability management cover how to keep this routine.